Vulnerability Details : CVE-2014-0209
Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path, which triggers a heap-based buffer overflow, related to metadata.
Vulnerability category: Overflow
Products affected by CVE-2014-0209
- cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:*:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:x:libxfont:1.4.99:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-0209
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 8 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-0209
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.6
|
MEDIUM | AV:L/AC:L/Au:N/C:P/I:P/A:P |
3.9
|
6.4
|
NIST |
CWE ids for CVE-2014-0209
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-0209
-
http://www.debian.org/security/2014/dsa-2927
Debian -- Security Information -- DSA-2927-1 libxfont
-
http://lists.x.org/archives/xorg-announce/2014-May/002431.html
[ANNOUNCE] X.Org Security Advisory: Multiple issues in libXfontVendor Advisory
-
http://www.mandriva.com/security/advisories?name=MDVSA-2015:145
mandriva.com
-
http://www.vmware.com/security/advisories/VMSA-2014-0012.html
VMSA-2014-0012.1
-
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
Oracle Critical Patch Update - July 2014
-
http://lists.opensuse.org/opensuse-updates/2014-05/msg00073.html
openSUSE-SU-2014:0711-1: moderate: libXfont: Fixed multiple vulnerabilit
-
http://secunia.com/advisories/59154
Sign in
-
http://www.securityfocus.com/bid/67382
X.Org libXfont Multiple Integer Overflow and Memory Corruption Vulnerabilities
-
http://seclists.org/fulldisclosure/2014/Dec/23
Full Disclosure: NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
-
http://advisories.mageia.org/MGASA-2014-0278.html
Mageia Advisory: MGASA-2014-0278 - Updated libxfont packages fix security vulnerabilities
-
http://www.securityfocus.com/archive/1/534161/100/0/threaded
SecurityFocus
-
http://www.ubuntu.com/usn/USN-2211-1
USN-2211-1: libXfont vulnerabilities | Ubuntu security notices
-
http://rhn.redhat.com/errata/RHSA-2014-1893.html
RHSA-2014:1893 - Security Advisory - Red Hat Customer Portal
Jump to