Summary
It was discovered that libXfont incorrectly followed symlinks when opening
font files. A local unprivileged user could use this issue to cause the X
server to access arbitrary files, including special device files.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | libxfont | 1:1.4.7-1ubuntu0.4 |
| Ubuntu · 16.04 LTS 16.04:LTS | libxfont | 1:1.5.1-1ubuntu0.16.04.4 |
| Ubuntu · 16.04 LTS 16.04:LTS | libxfont2 | 1:2.0.1-3~ubuntu16.04.3 |
Vulnerabilities 1
-
Unscored —
In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as ro…
References
-
report
https://ubuntu.com/security/CVE-2017-16611