Local File Access Vulnerability in libXfont and libXfont2
Summary
ALPINE-CVE-2017-16611: In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files. Affects libxfont versions < 1.5.4-r0. Fixed in 1.5.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libXfont and libXfont2 are libraries used in the X Window System for font management. They facilitate the rendering of fonts in graphical user interfaces, allowing applications to display text correctly. These libraries are essential for systems that rely on X11 for graphical output. However, they have been found to contain vulnerabilities that can be exploited by local attackers.
Vulnerability Detail
In libXfont versions prior to 1.5.4 and libXfont2 versions prior to 2.0.3, a local attacker can open files on the system with root privileges. This can trigger various system mechanisms such as tape rewinds or watchdogs, which can lead to unintended consequences. The vulnerability arises from improper handling of file access permissions, allowing unauthorized file operations.
How To Fix
Minimum fixed version
1.5.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade libxfontTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, restrict access to the affected libraries or limit the execution of applications that rely on them until the packages can be updated.
Conclusion
The vulnerability in libXfont and libXfont2 poses a risk to systems using these libraries, allowing local attackers to exploit file access permissions. It is crucial to update to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your applications.
See every vulnerability recorded for libxfont →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a medium severity level.
Any system using libXfont or libXfont2 versions prior to the patched versions is vulnerable, particularly systems running the X Window System.
No, this vulnerability can only be exploited by local attackers who have access to the system.
Exploitation can lead to unauthorized file access and manipulation, potentially compromising system integrity.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxfont.
