Vulnerability Details : CVE-2014-0210
Multiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs protocol reply to the (1) _fs_recv_conn_setup, (2) fs_read_open_font, (3) fs_read_query_info, (4) fs_read_extent_info, (5) fs_read_glyphs, (6) fs_read_list, or (7) fs_read_list_info function.
Vulnerability category: OverflowExecute code
Exploit prediction scoring system (EPSS) score for CVE-2014-0210
Probability of exploitation activity in the next 30 days: 2.55%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 89 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2014-0210
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2014-0210
-
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-0210
-
http://www.debian.org/security/2014/dsa-2927
Debian -- Security Information -- DSA-2927-1 libxfont
-
http://lists.x.org/archives/xorg-announce/2014-May/002431.html
[ANNOUNCE] X.Org Security Advisory: Multiple issues in libXfontVendor Advisory
-
http://www.mandriva.com/security/advisories?name=MDVSA-2015:145
mandriva.com
-
http://www.vmware.com/security/advisories/VMSA-2014-0012.html
VMSA-2014-0012.1
-
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
Oracle Critical Patch Update - July 2014
-
http://lists.opensuse.org/opensuse-updates/2014-05/msg00073.html
openSUSE-SU-2014:0711-1: moderate: libXfont: Fixed multiple vulnerabilit
-
http://secunia.com/advisories/59154
Sign in
-
http://www.securityfocus.com/bid/67382
X.Org libXfont Multiple Integer Overflow and Memory Corruption Vulnerabilities
-
http://seclists.org/fulldisclosure/2014/Dec/23
Full Disclosure: NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
-
http://advisories.mageia.org/MGASA-2014-0278.html
Mageia Advisory: MGASA-2014-0278 - Updated libxfont packages fix security vulnerabilities
-
http://www.securityfocus.com/archive/1/534161/100/0/threaded
SecurityFocus
-
http://www.ubuntu.com/usn/USN-2211-1
USN-2211-1: libXfont vulnerabilities | Ubuntu security notices
-
http://rhn.redhat.com/errata/RHSA-2014-1893.html
RHSA-2014:1893 - Security Advisory - Red Hat Customer Portal
Products affected by CVE-2014-0210
- cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:*:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.4.99:*:*:*:*:*:*:*