rpm package
opensuse/libXfont2&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/libXfont2&distro=openSUSE%20Tumbleweed
Vulnerabilities (6)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-59679 | Cri | 9.0 | < 2.0.7-3.1 | 2.0.7-3.1 | Sep 10, 2026 | fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two | |
| CVE-2026-44950 | Cri | 9.0 | < 2.0.7-3.1 | 2.0.7-3.1 | Sep 10, 2026 | fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination | |
| CVE-2026-56003 | Hig | 8.5 | < 2.0.7-2.1 | 2.0.7-2.1 | Jul 8, 2026 | A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server. | |
| CVE-2026-56002 | Hig | 8.5 | < 2.0.7-2.1 | 2.0.7-2.1 | Jul 8, 2026 | A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server. | |
| CVE-2026-56001 | Hig | 8.5 | < 2.0.7-2.1 | 2.0.7-2.1 | Jul 8, 2026 | A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server to execute code within the X server cont | |
| CVE-2017-16611 | Med | 5.5 | < 2.0.5-1.2 | 2.0.5-1.2 | Dec 1, 2017 | In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files. |
- affected < 2.0.7-3.1fixed 2.0.7-3.1
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two
- affected < 2.0.7-3.1fixed 2.0.7-3.1
fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination
- affected < 2.0.7-2.1fixed 2.0.7-2.1
A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server.
- affected < 2.0.7-2.1fixed 2.0.7-2.1
A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server.
- affected < 2.0.7-2.1fixed 2.0.7-2.1
A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server to execute code within the X server cont
- affected < 2.0.5-1.2fixed 2.0.5-1.2
In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files.