Description
Integer overflow in the scan_cidfont function in X.Org 6.8.2 and XFree86 X server allows local users to execute arbitrary code via crafted (1) CMap and (2) CIDFont font data with modified item counts in the (a) begincodespacerange, (b) cidrange, and (c) notdefrange sections.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxfont | 1:1.2.2-1 | — |
| Debian 13 | libxfont | 1:1.2.2-1 | — |
| Debian 12 | libxfont | 1:1.2.2-1 | — |
| Debian 3.1 | xfree86 | 4.3.0.dfsg.1-14sarge2 | DSA-1193-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | xorg-x11 +17 | 6.8.2-1.EL.13.37.2 | RHSA-2006:0665 |
| RHEL 3 | XFree86 +29 | 4.3.0-113.EL | RHSA-2006:0666 |
Advisories 3
- RHSA-2006:0666 Red Hat Security Advisory: XFree86 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0665 Red Hat Security Advisory: xorg-x11 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1193-1 xfree86 Debian Security (DSA / DLA) · Mar 9, 2026
References
- 23907 third-party-advisory
- RHSA-2006:0666 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-191.htm
- 21900 third-party-advisory
- MDKSA-2006:164 vendor-advisory
- 21904 third-party-advisory
- SUSE-SR:2006:023 vendor-advisory
- 21864 third-party-advisory
- 21894 third-party-advisory
- USN-344-1 vendor-advisory
- 21889 third-party-advisory
- 21908 third-party-advisory
- RHSA-2006:0665 vendor-advisory
- 22141 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-190.htm
- ADV-2007-1171 vdb-entry
- DSA-1193 vendor-advisory
- 22080 third-party-advisory
- https://issues.rpath.com/browse/RPL-614
- http://www.vmware.com/support/esx25/doc/esx-254-200702-patch.html
- 22332 third-party-advisory
- 22560 third-party-advisory
- 20070330 VMSA-2007-0002 VMware ESX security updates mailing-list
- 23033 third-party-advisory
- 20060912 rPSA-2006-0167-1 xorg-x11 xorg-x11-fonts xorg-x11-tools xorg-x11-xfs mailing-list
- 20060912 Multiple Vendor X Server CID-keyed Fonts 'scan_cidfont()' Integer Overflow Vulnerability third-party-advisory
- oval:org.mitre.oval:def:9454 vdb-entry signature
- GLSA-200609-07 vendor-advisory
- 102780 vendor-advisory
- 24636 third-party-advisory
- ADV-2007-0322 vdb-entry
- 21890 third-party-advisory
- 19974 vdb-entry
- 1016828 vdb-entry
- ADV-2006-3581 vdb-entry
- 21924 third-party-advisory
- ADV-2006-3582 vdb-entry
- 23899 third-party-advisory
- xorg-server-scancidfont-overflow(28890) vdb-entry