Description
Multiple integer overflows in the font libraries for XFree86 4.3.0 allow local or remote attackers to cause a denial of service or execute arbitrary code via heap-based and stack-based buffer overflow attacks.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | xfree86 | 4.1.0-16woody1 | DSA-380 |
Advisories 1
- DSA-380 xfree86 - buffer overflows, denial of service Debian Security (DSA / DLA) · Mar 9, 2026
References
- 24168 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-074.htm
- 20030830 Multiple integer overflows in XFree86 (local/remote) mailing-list
- CLA-2004:821 vendor-advisory
- ADV-2007-0589 vdb-entry
- 8514 vdb-entry
- MDKSA-2003:089 vendor-advisory
- RHSA-2003:289 vendor-advisory
- 102803 vendor-advisory
- RHSA-2003:287 vendor-advisory
- RHSA-2003:286 vendor-advisory
- 24247 third-party-advisory
- DSA-380 vendor-advisory
- RHSA-2003:288 vendor-advisory