Vulnerabilities > CVE-2017-13722 - Out-of-bounds Read vulnerability in X.Org Libxfont 2.0.0/2.0.1

047910
CVSS 3.6 - LOW
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
PARTIAL
local
low complexity
x-org
CWE-125
nessus

Summary

In the pcfGetProperties function in bitmap/pcfread.c in libXfont through 1.5.2 and 2.x before 2.0.2, a missing boundary check (for PCF files) could be used by local attackers authenticated to an Xserver for a buffer over-read, for information disclosure or a crash of the X server.

Vulnerable Configurations

Part Description Count
Application
X.Org
3

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Overread Buffers
    An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1126.NASL
    descriptionIt was discovered that there two vulnerabilities the library providing font selection and rasterisation, libxfont : - CVE-2017-13720: If a pattern contained a
    last seen2020-03-17
    modified2017-10-09
    plugin id103711
    published2017-10-09
    reporterThis script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/103711
    titleDebian DLA-1126-1 : libxfont security update
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Debian Security Advisory DLA-1126-1. The text
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(103711);
      script_version("3.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_name(english:"Debian DLA-1126-1 : libxfont security update");
      script_summary(english:"Checks dpkg output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "It was discovered that there two vulnerabilities the library providing
    font selection and rasterisation, libxfont :
    
      - CVE-2017-13720: If a pattern contained a '?' character
        any character in the string is skipped even if it was a
        '\0'. The rest of the matching then read invalid memory.
    
      - CVE-2017-13722: A malformed PCF file could cause the
        library to make reads from random heap memory that was
        behind the `strings` buffer, leading to an application
        crash or a information leak.
    
    For Debian 7 'Wheezy', this issue has been fixed in libxfont version
    1:1.4.5-5+deb7u1.
    
    We recommend that you upgrade your libxfont packages.
    
    NOTE: Tenable Network Security has extracted the preceding description
    block directly from the DLA security advisory. Tenable has attempted
    to automatically clean and format it as much as possible without
    introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.debian.org/debian-lts-announce/2017/10/msg00006.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/wheezy/libxfont"
      );
      script_set_attribute(attribute:"solution", value:"Upgrade the affected packages.");
      script_set_attribute(attribute:"risk_factor", value:"High");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libxfont-dev");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libxfont1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libxfont1-dbg");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libxfont1-udeb");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:7.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2017/10/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/10/09");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2020 Tenable Network Security, Inc.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"7.0", prefix:"libxfont-dev", reference:"1:1.4.5-5+deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"libxfont1", reference:"1:1.4.5-5+deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"libxfont1-dbg", reference:"1:1.4.5-5+deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"libxfont1-udeb", reference:"1:1.4.5-5+deb7u1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2625.NASL
    descriptionAccording to the versions of the libXfont package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files.(CVE-2017-16611) - In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with access to an X connection can cause a buffer over-read during pattern matching of fonts, leading to information disclosure or a crash (denial of service). This occurs because
    last seen2020-05-08
    modified2019-12-18
    plugin id132160
    published2019-12-18
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132160
    titleEulerOS 2.0 SP3 : libXfont (EulerOS-SA-2019-2625)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2357.NASL
    descriptionAccording to the versions of the libXfont package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.(CVE-2011-2895) - In the pcfGetProperties function in bitmap/pcfread.c in libXfont through 1.5.2 and 2.x before 2.0.2, a missing boundary check (for PCF files) could be used by local attackers authenticated to an Xserver for a buffer over-read, for information disclosure or a crash of the X server.(CVE-2017-13722) - In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with access to an X connection can cause a buffer over-read during pattern matching of fonts, leading to information disclosure or a crash (denial of service). This occurs because
    last seen2020-05-08
    modified2019-12-10
    plugin id131849
    published2019-12-10
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131849
    titleEulerOS 2.0 SP2 : libXfont (EulerOS-SA-2019-2357)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3995.NASL
    descriptionTwo vulnerabilities were found in libXfont, the X11 font rasterisation library, which could result in denial of service or memory disclosure.
    last seen2020-06-01
    modified2020-06-02
    plugin id103757
    published2017-10-11
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/103757
    titleDebian DSA-3995-1 : libxfont - security update
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1459.NASL
    descriptionAccording to the versions of the libXfont package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files.(CVE-2017-16611) - In the pcfGetProperties function in bitmap/pcfread.c in libXfont through 1.5.2 and 2.x before 2.0.2, a missing boundary check (for PCF files) could be used by local attackers authenticated to an Xserver for a buffer over-read, for information disclosure or a crash of the X server.(CVE-2017-13722) - In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with access to an X connection can cause a buffer over-read during pattern matching of fonts, leading to information disclosure or a crash (denial of service). This occurs because
    last seen2020-04-30
    modified2020-04-16
    plugin id135621
    published2020-04-16
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135621
    titleEulerOS Virtualization 3.0.2.2 : libXfont (EulerOS-SA-2020-1459)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-0334-1.NASL
    descriptionThis update for libXfont fixes several issues. These security issues were fixed : - CVE-2017-13720: Improper check for end of string in PatterMatch caused invalid reads (bsc#1054285) - CVE-2017-13722: Malformed PCF file could have caused DoS or leak information (bsc#1049692) - Prevent the X server from accessing arbitrary files as root. It is not possible to leak information, but special files can be touched allowing for causing side effects (bsc#1050459) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id106576
    published2018-02-02
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/106576
    titleSUSE SLED12 / SLES12 Security Update : libXfont (SUSE-SU-2018:0334-1)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1241.NASL
    descriptionAccording to the versions of the libXfont package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files.(CVE-2017-16611) - In the pcfGetProperties function in bitmap/pcfread.c in libXfont through 1.5.2 and 2.x before 2.0.2, a missing boundary check (for PCF files) could be used by local attackers authenticated to an Xserver for a buffer over-read, for information disclosure or a crash of the X server.(CVE-2017-13722) - In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with access to an X connection can cause a buffer over-read during pattern matching of fonts, leading to information disclosure or a crash (denial of service). This occurs because
    last seen2020-03-19
    modified2020-03-13
    plugin id134530
    published2020-03-13
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134530
    titleEulerOS Virtualization for ARM 64 3.0.2.0 : libXfont (EulerOS-SA-2020-1241)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2017-2783EF2C63.NASL
    descriptionSecurity fix for CVE-2017-13720 and CVE-2017-13722 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2017-10-26
    plugin id104148
    published2017-10-26
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104148
    titleFedora 26 : libXfont (2017-2783ef2c63)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2539.NASL
    descriptionAccording to the versions of the libXfont package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with access to an X connection can cause a buffer over-read during pattern matching of fonts, leading to information disclosure or a crash (denial of service). This occurs because
    last seen2020-05-08
    modified2019-12-09
    plugin id131813
    published2019-12-09
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131813
    titleEulerOS 2.0 SP5 : libXfont (EulerOS-SA-2019-2539)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201711-08.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201711-08 (LibXfont, LibXfont2: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in LibXfont and LibXfont2. Please review the referenced CVE identifiers for details. Impact : Local attackers could obtain sensitive information or possibly cause a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id104516
    published2017-11-13
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104516
    titleGLSA-201711-08 : LibXfont, LibXfont2: Multiple vulnerabilities
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3442-1.NASL
    descriptionIt was discovered that libXfont incorrectly handled certain patterns in PatternMatch. A local attacker could use this issue to cause libXfont to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2017-13720) It was discovered that libXfont incorrectly handled certain malformed PCF files. A local attacker could use this issue to cause libXfont to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2017-13722). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id103774
    published2017-10-11
    reporterUbuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/103774
    titleUbuntu 14.04 LTS / 16.04 LTS / 17.04 : libxfont, libxfont1, libxfont2 vulnerabilities (USN-3442-1)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2017-F3E5D31524.NASL
    descriptionSecurity fix for CVE-2017-13720 and CVE-2017-13722 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2018-01-15
    plugin id106003
    published2018-01-15
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/106003
    titleFedora 27 : libXfont (2017-f3e5d31524)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2017-1357.NASL
    descriptionThis update for libXfont fixes several issues. These security issues were fixed : - CVE-2017-13720: Improper check for end of string in PatterMatch caused invalid reads (bsc#1054285) - CVE-2017-13722: Malformed PCF file could have caused DoS or leak information (bsc#1049692) - Prevent the X server from accessing arbitrary files as root. It is not possible to leak information, but special files can be touched allowing for causing side effects (bsc#1050459)
    last seen2020-06-05
    modified2017-12-14
    plugin id105240
    published2017-12-14
    reporterThis script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/105240
    titleopenSUSE Security Update : libXfont (openSUSE-2017-1357)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2017-B7C4334524.NASL
    descriptionSecurity fix for CVE-2017-13720 and CVE-2017-13722 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2017-10-26
    plugin id104157
    published2017-10-26
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104157
    titleFedora 25 : libXfont (2017-b7c4334524)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2018-124.NASL
    descriptionThis update for libXfont fixes several issues. These security issues were fixed : - CVE-2017-13720: Improper check for end of string in PatterMatch caused invalid reads (bsc#1054285) - CVE-2017-13722: Malformed PCF file could have caused DoS or leak information (bsc#1049692) - Prevent the X server from accessing arbitrary files as root. It is not possible to leak information, but special files can be touched allowing for causing side effects (bsc#1050459) This update was imported from the SUSE:SLE-12-SP2:Update update project.
    last seen2020-06-05
    modified2018-02-02
    plugin id106569
    published2018-02-02
    reporterThis script is Copyright (C) 2018-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/106569
    titleopenSUSE Security Update : libXfont (openSUSE-2018-124)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-0246-1.NASL
    descriptionThis update for xorg-x11-libs fixes several issues. These security issues were fixed : - CVE-2017-16612: Heap overflows due to an integer overflow while parsing images and a signedness issue while parsing comments (bsc#1065386). - CVE-2017-13720: Improper check for end of string in PatterMatch caused invalid reads (bsc#1054285) - CVE-2017-13722: Malformed PCF file could have caused DoS or leak information (bsc#1049692) - Prevent the X server from accessing arbitrary files as root. It is not possible to leak information, but special files can be touched allowing for causing side effects (bsc#1050459) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id106449
    published2018-01-29
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/106449
    titleSUSE SLES11 Security Update : xorg-x11-libs (SUSE-SU-2018:0246-1)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_3B9590A1E35811E7A29354E1AD3D6335.NASL
    descriptionThe freedesktop.org project reports : If a pattern contains
    last seen2020-06-01
    modified2020-06-02
    plugin id105336
    published2017-12-18
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/105336
    titleFreeBSD : libXfont -- multiple memory leaks (3b9590a1-e358-11e7-a293-54e1ad3d6335)