Security Update for libxfont
Summary
DLA-1126-1: libxfont - security update. Affects libxfont versions < 1:1.4.5-5+deb7u1. Fixed in 1:1.4.5-5+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxfont is a library that provides font selection and rasterization functionality. It is used by various applications to handle fonts and render text on X Window System servers. This vulnerability affects libxfont in Debian 7 Wheezy.
Vulnerability Detail
There are two vulnerabilities in libxfont:
-
CVE-2017-13720: If a pattern in a font selection contained a '?' character, any character in the string would be skipped, even if it was a '\0' character. This could lead to reading invalid memory and potentially result in a security breach.
-
CVE-2017-13722: A malformed PCF (Portable Compiled Format) file could cause libxfont to read from random heap memory that was behind the 'strings' buffer. This could lead to application crashes or information leaks.
How To Fix
Minimum fixed version
1:1.4.5-5+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxfontTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for these vulnerabilities.
Conclusion
Upgrading the libxfont package to the recommended version will address these vulnerabilities. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libxfont →
FAQ
libxfont is a library used for font selection and rasterization in X Window System servers.
CVE-2017-13720 is a vulnerability in libxfont that allows for reading invalid memory if a font selection pattern contains a '?' character.
CVE-2017-13722 is a vulnerability in libxfont that can cause the library to read from random heap memory when processing a malformed PCF file.
To fix these vulnerabilities, you should upgrade the libxfont package to version 1:1.4.5-5+deb7u1 or later.
No, there is no known workaround for these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for libxfont.
