CVE-2017-13722
Fixed in a distro release EPSS <1%
In the pcfGetProperties function in bitmap/pcfread.c in libXfont through 1.5.2 and 2.x before 2.0.2, a missing boundary check (for PCF files) could be used by local attackers authenticated to an Xserver for a buffer over-read, for information disclosure or a crash of the X server.
Products: x.org libxfont
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libxfont | 1:2.0.1-4 |
| Debian 13 | libxfont | 1:2.0.1-4 |
| Debian 14 | libxfont | 1:2.0.1-4 |
| Debian 7 | libxfont | 1:1.4.5-5+deb7u1 |
| Debian 8 | libxfont | 1:1.5.1-1+deb8u1 |
| Debian 9 | libxfont | 1:2.0.1-3+deb9u1 |
| SUSE Linux Enterprise Desktop 12 SP2 | libXfont | 1.5.1-11.3.12 |
| SUSE Linux Enterprise Desktop 12 SP3 | libXfont | 1.5.1-11.3.12 |
| SUSE Linux Enterprise Server 11 SP4 | xorg-x11-libs | 7.4-8.26.50.5.3 |
| SUSE Linux Enterprise Server 12 SP2 | libXfont | 1.5.1-11.3.12 |
| SUSE Linux Enterprise Server 12 SP3 | libXfont | 1.5.1-11.3.12 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | libXfont | 1.5.1-11.3.12 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | xorg-x11-libs | 7.4-8.26.50.5.3 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | libXfont | 1.5.1-11.3.12 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | libXfont | 1.5.1-11.3.12 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | xorg-x11-libs | 7.4-8.26.50.5.3 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | libXfont | 1.5.1-11.3.12 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | libXfont | 1.5.1-11.3.12 |
| Ubuntu 14.04 LTS | libxfont | 1:1.4.7-1ubuntu0.3 |
| Ubuntu 16.04 LTS | libxfont | 1:1.5.1-1ubuntu0.16.04.3 |
| Ubuntu 16.04 LTS | libxfont2 | 1:2.0.1-3~ubuntu16.04.2 |
| openSUSE Tumbleweed | libXfont | 1.5.4-2.18 |