fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.0.3-150000.3.6.1, 2.0.7-160000.5.1, 2.0.3-3.6.1, 2.0.6-5.el10_2.3, 2.0.3-2.el8_10.3, and 2 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.7-160000.5.1
- libXfont2-2
fixed in 2.0.7-160000.5.1
- libXfont2-2
fixed in 2.0.7-160000.5.1
- libXfont2-2
fixed in 2.0.7-160000.5.1
- libXfont2-2
fixed in 2.0.7-160000.5.1
- libXfont2-2
fixed in 2.0.7-160000.5.1
- libXfont2-2
fixed in 2.0.7-160000.5.1
- libXfont2-2
fixed in 2.0.7-160000.5.1
- libXfont2-2
fixed in 2.0.3-3.6.1
- libXfont2-2
fixed in 2.0.3-3.6.1
- libXfont2-2
fixed in 2.0.3-3.6.1
- libXfont2-2
fixed in 2.0.3-3.6.1
- libXfont2-2
fixed in 2.0.3-3.6.1
- libXfont2-2
fixed in 2.0.3-3.6.1
- libXfont2
fixed in 2.0.6-5.el10_2.3
- libXfont2-devel
fixed in 2.0.6-5.el10_2.3
- libXfont2
fixed in 2.0.3-2.el8_10.3
- libXfont2-devel
fixed in 2.0.3-2.el8_10.3
- libXfont2
fixed in 2.0.3-12.el9_8.3
- libXfont2-devel
fixed in 2.0.3-12.el9_8.3
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-devel
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-devel
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-devel
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-devel
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-devel
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-devel
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-devel
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-devel
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-devel
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-devel
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-devel
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.7-160000.5.1
- libXfont2-devel
fixed in 2.0.7-160000.5.1
- libXfont2-2
fixed in 2.0.7-160000.5.1
- libXfont2-devel
fixed in 2.0.7-160000.5.1
- libXfont2-2
fixed in 2.0.3-3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-devel
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-devel
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-devel
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-devel
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-devel
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.3-150000.3.6.1
- libXfont2-devel
fixed in 2.0.3-150000.3.6.1
- libXfont2-2
fixed in 2.0.7-160000.5.1
- libXfont2-devel
fixed in 2.0.7-160000.5.1
- libXfont2-2
fixed in 2.0.7-3.1
- libXfont2-2-32bit
fixed in 2.0.7-3.1
- libXfont2-devel
fixed in 2.0.7-3.1
- libXfont2-devel-32bit
fixed in 2.0.7-3.1
- libXfont2
through 2.0.8