Detections
Analytics
FreeBSD : libXfont -- BDF parsing issues (f7d79fac-cd49-11e4-898f-bcaec565249c)
high Nessus Plugin ID 81901
Language:
Synopsis
The remote FreeBSD host is missing one or more security-related updates.Description
Alan Coopersmith reports :Ilja van Sprundel, a security researcher with IOActive, has discovered an issue in the parsing of BDF font files by libXfont. Additional testing by Alan Coopersmith and William Robinet with the American Fuzzy Lop (afl) tool uncovered two more issues in the parsing of BDF font files.
As libXfont is used by the X server to read font files, and an unprivileged user with access to the X server can tell the X server to read a given font file from a path of their choosing, these vulnerabilities have the potential to allow unprivileged users to run code with the privileges of the X server (often root access).
Solution
Update the affected packages.See Also
https://lists.x.org/archives/xorg-announce/2015-March/002550.html
Plugin Details
Severity: High
ID: 81901
File Name: freebsd_pkg_f7d79faccd4911e4898fbcaec565249c.nasl
Version: 1.8
Type: local
Family: FreeBSD Local Security Checks
Published: 3/18/2015
Updated: 1/6/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 8.5
Vector: CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:freebsd:freebsd:libxfont, p-cpe:/a:freebsd:freebsd:linux-c6-xorg-libs, p-cpe:/a:freebsd:freebsd:linux-f10-xorg-libs, cpe:/o:freebsd:freebsd
Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info
Patch Publication Date: 3/18/2015
Vulnerability Publication Date: 3/17/2015