Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 144092

Summary: x11-base/xorg-x11, x11-libs/libXfont, maybe other? : integer overflows in the PCF font parser
Product: Gentoo Security Reporter: Raphael Marichez (Falco) (RETIRED) <falco>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: major CC: x11
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: A2/3 [glsa] Falco
Package list:
Runtime testing required: ---

Description Raphael Marichez (Falco) (RETIRED) gentoo-dev 2006-08-16 03:03:39 UTC
SA 21446 & SA 21450 :

Software:	XFree86 4.1.x
XFree86 4.2.x
XFree86 4.3.x
XFree86 4.4.x
XFree86 4.5.x
XFree86 4.6.x
A vulnerability has been reported in XFree86, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

The vulnerability is caused due to integer overflows in the PCF font parser and can be exploited to crash the X server and potentially execute arbitrary code.

This is related to:

Do not parse untrusted PCF font files.

Other References:

Software:	X Window System 11 (X11) 6.x
X Window System 11 (X11) 7.x

A vulnerability has been reported in libXfont, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise an application using the library.

The vulnerability is caused due to integer overflows within the PCF font file parser. This can potentially be exploited to cause a heap-based buffer overflow via a specially crafted font file.

This is related to:

Successful exploitation may allow execution of arbitrary code.

Apply patch.

Original Advisory:

Other References:
Comment 1 Raphael Marichez (Falco) (RETIRED) gentoo-dev 2006-08-16 03:05:11 UTC
We tried it at work and we only crashes the application (not the whole X screen), because of a crash in a strlen() before being able to exploit the overflow. So DoS.

But Secunia rates it as maybe code execution.
Comment 2 Donnie Berkholz (RETIRED) gentoo-dev 2006-08-20 14:36:20 UTC
libXfont 1.2.0-r1 is in the tree and fixed. All arches should expect to stabilize on it, including sparc, which should stabilize on modular X now that its final blocker is gone.

Older, monolithic ebuilds may or may not be fixed as time permits.
Comment 3 Raphael Marichez (Falco) (RETIRED) gentoo-dev 2006-08-21 01:05:01 UTC
Hi arches, x11-libs/libXfont-1.2.0-r1 is to be tested and marked stable if possible, thanks.

modular xorg-x11 isn't stabilized for Sparc yet : we'll see if there is a fixed xorg-x11-6.x ebuild in a reasonable time, otherwise we will have to decide between a tempGLSA without Sparc, or a stabilization of xorg-x11-7.x .

(and maybe a little people like me still uses the 6.x branch because the 7.x branch sucks with certain drivers :(   )

Comment 4 Christian Faulhammer (RETIRED) gentoo-dev 2006-08-21 09:34:19 UTC
1) emerges fine
2) passes collision test
3) X server starts up and works with Gnome, KDE and XSession

Portage 2.1-r2 (default-linux/x86/2006.0, gcc-3.4.6, glibc-2.3.6-r4, 2.6.17-gentoo-r4 i686)
System uname: 2.6.17-gentoo-r4 i686 AMD Athlon(tm) XP 2500+
Gentoo Base System version 1.12.4
app-admin/eselect-compiler: [Not Present]
dev-lang/python:     2.4.3-r1
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     [Not Present]
dev-util/confcache:  [Not Present]
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.59-r7
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.13-r3
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r2
CONFIG_PROTECT="/etc /usr/share/X11/xkb"
CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/revdep-rebuild /etc/splash /etc/terminfo"
FEATURES="autoconfig ccache collision-protect distlocks metadata-transfer parallel-fetch sandbox sfperms strict test"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude='/distfiles' --exclude='/local' --exclude='/packages'"
USE="x86 3dnow 3dnowext X Xaw3d a52 alsa arts artworkextra asf audiofile avi bash-completion beagle berkdb bidi bitmap-fonts bootsplash branding bzip2 cairo cdda cddb cdparanoia cdr cli cracklib crypt css cups curl custom-cflags dbus dga directfb divx4linux dlloader dri dts dvd dvdr dvdread dvi eds emacs emboss encode esd evo exif expat fam fat fbcon ffmpeg firefox foomaticdb fortran ftp gb gcj gdbm gif gnome gpm gstreamer gtk gtk2 gtkhtml hal icq idn imagemagick imap imlib ipv6 isdnlog java javascript jikes jpeg jpeg2k ldap leim libg++ libwww lm_sensors mad maildir matroska mbox mikmod mime mmx mmxext mng mono motif mp3 mpeg mpeg2 mule nautilus ncurses nforce2 nls nocardbus nptl nptlonly nsplugin nvidia objc ogg opengl pam pcre pdf pdflib perl plotutils pmu png ppds pppd preview-latex print python qt3 qt4 quicktime readline reflection reiserfs samba sdk session slang spell spl sse ssl svg svga t1lib tcltk tcpd tetex theora thunderbird tiff truetype truetype-fonts type1-fonts udev usb vcd videos vorbis win32codecs wmf wxwindows xine xml xorg xosd xv xvid zlib elibc_glibc input_devices_mouse input_devices_keyboard kernel_linux linguas_de userland_GNU video_cards_radeon video_cards_vesa video_cards_fbdev"
Comment 5 Tobias Scherbaum (RETIRED) gentoo-dev 2006-08-21 11:04:13 UTC
ppc stable
Comment 6 Markus Rothe (RETIRED) gentoo-dev 2006-08-21 12:30:40 UTC
ppc64 stable
Comment 7 Joshua Jackson (RETIRED) gentoo-dev 2006-08-21 20:26:18 UTC
x86 is gone ^.^
Comment 8 Thomas Cort (RETIRED) gentoo-dev 2006-08-21 21:24:11 UTC
alpha and amd64 stable.
Comment 9 Ferris McCormick (RETIRED) gentoo-dev 2006-08-22 05:25:06 UTC
Stable for sparc.
Comment 10 Stephen Becker (RETIRED) gentoo-dev 2006-08-22 06:58:49 UTC
stable on mips
Comment 11 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-08-22 22:09:12 UTC
Accepting bug.
Comment 12 René Nussbaumer (RETIRED) gentoo-dev 2006-08-23 05:59:52 UTC
stable on hppa
Comment 13 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-09-06 13:29:49 UTC
GLSA 200609-04

Remailed again,again to FD due to DNS failures. Apparently sent but not received yet.