FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  512420
Date:      2019-09-20
Time:      15:56:44Z
Committer: pi

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
b060ee50-daba-11e3-99f2-bcaec565249clibXfont -- X Font Service Protocol and Font metadata file handling issues

Alan Coopersmith reports:

Ilja van Sprundel, a security researcher with IOActive, has discovered several issues in the way the libXfont library handles the responses it receives from xfs servers, and has worked with X.Org's security team to analyze, confirm, and fix these issues.

Most of these issues stem from libXfont trusting the font server to send valid protocol data, and not verifying that the values will not overflow or cause other damage. This code is commonly called from the X server when an X Font Server is active in the font path, so may be running in a setuid-root process depending on the X server in use. Exploits of this path could be used by a local, authenticated user to attempt to raise privileges; or by a remote attacker who can control the font server to attempt to execute code with the privileges of the X server.


Discovery 2014-05-13
Entry 2014-05-13
Modified 2015-07-15
libXfont
lt 1.4.7_3

linux-c6-xorg-libs
lt 7.4_2

linux-f10-xorg-libs
ge *

CVE-2014-0209
CVE-2014-0210
CVE-2014-0211
http://lists.x.org/archives/xorg-announce/2014-May/002431.html
f7d79fac-cd49-11e4-898f-bcaec565249clibXfont -- BDF parsing issues

Alan Coopersmith reports:

Ilja van Sprundel, a security researcher with IOActive, has discovered an issue in the parsing of BDF font files by libXfont. Additional testing by Alan Coopersmith and William Robinet with the American Fuzzy Lop (afl) tool uncovered two more issues in the parsing of BDF font files.

As libXfont is used by the X server to read font files, and an unprivileged user with access to the X server can tell the X server to read a given font file from a path of their choosing, these vulnerabilities have the potential to allow unprivileged users to run code with the privileges of the X server (often root access).


Discovery 2015-03-17
Entry 2015-03-18
Modified 2016-01-31
libXfont
lt 1.5.1

linux-c6-xorg-libs
lt 7.4_4

linux-f10-xorg-libs
lt 7.4_4

http://lists.x.org/archives/xorg-announce/2015-March/002550.html
CVE-2015-1802
CVE-2015-1803
CVE-2015-1804