Home / Early Warning / Vulnerabilidades / CVE-2014-0209

CVE-2014-0209

Type: 
Numeric Errors
Severity: 
Medium
Publication date: 
05/15/2014
Last modified: 
10/09/2018
Description
Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path, which triggers a heap-based buffer overflow, related to metadata.
Impact
Access Vector: Local
Access Complexity: Low
Authentication: Not required to exploit
Impact Type: Partially affects on system integrity + Partially affects on system confidentiality + Partially affects on system availability
Vulnerable software and versions
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.4.99:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.4.6:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.4.5:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.4.4:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.3.4:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.2.9:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.2.8:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.2.7:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.2.6:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.2.5:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:*:*:*:*:*:*:*:*
To consult the complete list of products and versions see this page
Explanation of fields