Description
Buffer overflow in ReadFontAlias from dirfile.c of XFree86 4.1.0 through 4.3.0 allows local users and remote attackers to execute arbitrary code via a font alias file (font.alias) with a long token, a different vulnerability than CVE-2004-0084 and CVE-2004-0106.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | xfree86 | 4.1.0-16woody3 | DSA-443 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | XFree86 +28 | 4.3.0-55.EL | RHSA-2004:061 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- XFree86 4.3 - Font Information File Buffer Overflow EDB-23682 · local · Nov 10, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- RHSA-2004:061 Red Hat Security Advisory: XFree86 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-443 xfree86 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- SuSE-SA:2004:006 vendor-advisory
- RHSA-2004:060 vendor-advisory
- xfree86-fontalias-bo(15130) vdb-entry
- 57768 vendor-advisory
- CLA-2004:821 vendor-advisory
- http://www.idefense.com/application/poi/display?id=72
- 9636 vdb-entry
- GLSA-200402-02 vendor-advisory
- 20040210 iDEFENSESecurityAdvisory02.10.04: XFree86FontInformationFileBufferOverflow mailing-list
- FLSA:2314 vendor-advisory
- DSA-443 vendor-advisory
- oval:org.mitre.oval:def:806 vdb-entry signature
- MDKSA-2004:012 vendor-advisory
- oval:org.mitre.oval:def:830 vdb-entry signature
- RHSA-2004:059 vendor-advisory
- http://www.xfree86.org/cvs/changes
- VU#820006 third-party-advisory
- 20040211 XFree86 vulnerability exploit mailing-list
- oval:org.mitre.oval:def:9612 vdb-entry signature
- RHSA-2004:061 vendor-advisory
- SSA:2004-043 vendor-advisory