Integer overflow in the scan_cidfont function in X.Org 6.8.2 and XFree86 X server allows local users to execute arbitrary code via crafted (1) CMap and (2) CIDFont font data with modified item counts in the (a) begincodespacerange, (b) cidrange, and (c) notdefrange sections.

From Red Hat Security Advisory 2006:0665 :

Updated X.org packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

X.org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

iDefense reported two integer overflow flaws in the way the X.org server processed CID font files. A malicious authorized client could exploit this issue to cause a denial of service (crash) or potentially execute arbitrary code with root privileges on the X.org server.
(CVE-2006-3739, CVE-2006-3740)

Users of X.org should upgrade to these updated packages, which contain a backported patch and is not vulnerable to this issue.

This update fixes an integer overflow vulnerability when rendering CID-keyed fonts. (CVE-2006-3739 / CVE-2006-3740)

iDefense security researchers found several integer overflows in X.org's font handling library. By using a specially crafted Type1 CID font file, a local user could exploit these to crash the X server or execute arbitrary code with root privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes an integer overflow vulnerability when rendering CID-keyed fonts (CVE-2006-3739/CVE-2006-3740).

Local exploitation of an integer overflow vulnerability in the 'CIDAFM()' function in the X.Org and XFree86 X server could allow an attacker to execute arbitrary code with privileges of the X server, typically root (CVE-2006-3739).

Local exploitation of an integer overflow vulnerability in the 'scan_cidfont()' function in the X.Org and XFree86 X server could allow an attacker to execute arbitrary code with privileges of the X server, typically root (CVE-2006-3740).

Updated packages are patched to address this issue.

Update :

Updated packages for 2007.0 have been patched (libxfont)

Several vulnerabilities have been discovered in the X Window System, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-3467     Chris Evan discovered an integer overflow in the code to     handle PCF fonts, which might lead to denial of service     if a malformed font is opened.

  - CVE-2006-3739     It was discovered that an integer overflow in the code     to handle Adobe Font Metrics might lead to the execution     of arbitrary code.

  - CVE-2006-3740     It was discovered that an integer overflow in the code     to handle CMap and CIDFont font data might lead to the     execution of arbitrary code.

  - CVE-2006-4447     The XFree86 initialization code performs insufficient     checking of the return value of setuid() when dropping     privileges, which might lead to local privilege     escalation.

New x11 (X.Org) packages are available for Slackware 10.2, and
-current to fix security issues due to overflows in font parsing.

The remote host is affected by the vulnerability described in GLSA-200609-07 (LibXfont, monolithic X.org: Multiple integer overflows)

    Several integer overflows have been found in the CID font parser.
  Impact :

    A remote attacker could exploit this vulnerability by enticing a user     to load a malicious font file resulting in the execution of arbitrary     code with the permissions of the user running the X server which     typically is the root user. A local user could exploit this     vulnerability to gain elevated privileges.
  Workaround :

    Disable CID-encoded Type 1 fonts by removing the 'type1' module and     replacing it with the 'freetype' module in xorg.conf.

Updated XFree86 packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1 and 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

XFree86 is an implementation of the X Window System, which provides the core functionality for the Linux graphical desktop.

iDefense reported two integer overflow flaws in the way the XFree86 server processed CID font files. A malicious authorized client could exploit this issue to cause a denial of service (crash) or potentially execute arbitrary code with root privileges on the XFree86 server.
(CVE-2006-3739, CVE-2006-3740)

Users of XFree86 should upgrade to these updated packages, which contain a backported patch and is not vulnerable to this issue.

Updated X.org packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

X.org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

iDefense reported two integer overflow flaws in the way the X.org server processed CID font files. A malicious authorized client could exploit this issue to cause a denial of service (crash) or potentially execute arbitrary code with root privileges on the X.org server.
(CVE-2006-3739, CVE-2006-3740)

Users of X.org should upgrade to these updated packages, which contain a backported patch and is not vulnerable to this issue.

ID	Name	Product	Family	Severity
67407	Oracle Linux 4 : xorg-x11 (ELSA-2006-0665)	Nessus	Oracle Linux Local Security Checks	high
29605	SuSE 10 Security Update : xorg-x11-server (ZYPP Patch Number 2062)	Nessus	SuSE Local Security Checks	high
27923	Ubuntu 5.04 / 5.10 / 6.06 LTS : libxfont, xorg vulnerabilities (USN-344-1)	Nessus	Ubuntu Local Security Checks	high
27494	openSUSE 10 Security Update : xorg-x11-server (xorg-x11-server-2056)	Nessus	SuSE Local Security Checks	high
23908	Mandrake Linux Security Advisory : xorg-x11 (MDKSA-2006:164-1)	Nessus	Mandriva Local Security Checks	high
22734	Debian DSA-1193-1 : xfree86 - several vulnerabilities	Nessus	Debian Local Security Checks	high
22420	Slackware 10.2 / current : x11 (SSA:2006-259-01)	Nessus	Slackware Local Security Checks	high
22352	GLSA-200609-07 : LibXfont, monolithic X.org: Multiple integer overflows	Nessus	Gentoo Local Security Checks	high
22347	RHEL 2.1 / 3 : XFree86 (RHSA-2006:0666)	Nessus	Red Hat Local Security Checks	high
22346	RHEL 4 : xorg-x11 (RHSA-2006:0665)	Nessus	Red Hat Local Security Checks	high
22340	CentOS 3 : XFree86 (CESA-2006:0666)	Nessus	CentOS Local Security Checks	high
22339	CentOS 4 : xorg-x11 (CESA-2006:0665)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2006-3740

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high