Description
Integer overflow in the bdfReadCharacters function in bdfread.c in (1) X.Org libXfont before 20070403 and (2) freetype 2.3.2 and earlier allows remote authenticated users to execute arbitrary code via crafted BDF fonts, which result in a heap overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | freetype | 2.3.5-1 | — |
| Debian 14 | libxfont | 1:1.2.2-2 | — |
| Debian 13 | freetype | 2.3.5-1 | — |
| Debian 13 | libxfont | 1:1.2.2-2 | — |
| Debian 12 | freetype | 2.3.5-1 | — |
| Debian 12 | libxfont | 1:1.2.2-2 | — |
| Debian 4.0 | freetype | 2.2.1-5+etch2 | DSA-1454-1 |
| Debian 3.1 | xfree86 | 4.3.0.dfsg.1-14sarge4 | DSA-1294-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | freetype +2 | 2.2.1-17.el5 | RHSA-2007:0150 |
| RHEL 5 | libXfont +1 | 1.2.2-1.0.2.el5 | RHSA-2007:0132 |
| RHEL 4 | freetype +3 | 2.1.9-5.el4 | RHSA-2007:0150 |
| RHEL 4 | xorg-x11 +17 | 6.8.2-1.EL.13.37.7 | RHSA-2007:0126 |
| RHEL 3 | XFree86 +29 | 4.3.0-120.EL | RHSA-2007:0125 |
| RHEL 3 | freetype +1 | 2.1.4-6.el3 | RHSA-2007:0150 |
| RHEL 2 | XFree86 +19 | 4.1.0-82.EL | RHSA-2007:0125 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | freetype2 | 2.11.0-1.2 | openSUSE-SU-2024:10770-1 |
Advisories 7
- RHSA-2007:0132 Red Hat Security Advisory: libXfont security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0125 Red Hat Security Advisory: XFree86 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0150 Red Hat Security Advisory: freetype security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0126 Red Hat Security Advisory: xorg-x11 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1454-1 freetype - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1294-1 xfree86 Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10770-1 freetype2-devel-2.11.0-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- RHSA-2007:0150 vendor-advisory
- 24745 third-party-advisory
- 24921 third-party-advisory
- oval:org.mitre.oval:def:1810 vdb-entry signature
- 33937 third-party-advisory
- 2007-0013 vendor-advisory
- 24771 third-party-advisory
- GLSA-200705-02 vendor-advisory
- 24889 third-party-advisory
- 24770 third-party-advisory
- 25006 third-party-advisory
- 24756 third-party-advisory
- http://sourceforge.net/project/shownotes.php?group_id=3157&release_id=498954
- 25495 third-party-advisory
- 24996 third-party-advisory
- 23283 vdb-entry
- RHSA-2007:0126 vendor-advisory
- 23300 vdb-entry
- http://support.apple.com/kb/HT3438
- GLSA-200705-10 vendor-advisory
- USN-448-1 vendor-advisory
- APPLE-SA-2009-02-12 vendor-advisory
- MDKSA-2007:080 vendor-advisory
- SSA:2007-109-01 vendor-advisory
- SUSE-SR:2007:006 vendor-advisory
- MDKSA-2007:081 vendor-advisory
- DSA-1454 vendor-advisory
- 24758 third-party-advisory
- ADV-2007-1264 vdb-entry
- 1017857 vdb-entry
- 24885 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-178.htm
- 25096 third-party-advisory
- 25195 third-party-advisory
- RHSA-2007:0125 vendor-advisory
- 24741 third-party-advisory
- APPLE-SA-2007-11-14 vendor-advisory
- 24776 third-party-advisory
- 28333 third-party-advisory
- 24768 third-party-advisory
- [xorg-announce] 20070403 various integer overflow vulnerabilites in xserver, libX11 and libXfont mailing-list
- 24791 third-party-advisory
- SUSE-SA:2007:027 vendor-advisory
- 30161 third-party-advisory
- GLSA-200805-07 vendor-advisory
- http://sourceforge.net/project/shownotes.php?release_id=498954
- DSA-1294 vendor-advisory
- 24765 third-party-advisory
- 25216 third-party-advisory
- 20070403 Multiple Vendor X Server BDF Font Parsing Integer Overflow Vulnerability third-party-advisory
- 20070404 rPSA-2007-0065-1 freetype xorg-x11 xorg-x11-fonts xorg-x11-tools xorg-x11-xfs mailing-list
- 20070405 FLEA-2007-0009-1: xorg-x11 freetype mailing-list
- ADV-2007-1548 vdb-entry
- xorg-bdf-font-bo(33417) vdb-entry
- 102886 vendor-advisory
- ADV-2007-1217 vdb-entry
- [4.0] 011: SECURITY FIX: April 4, 2007 vendor-advisory
- https://issues.rpath.com/browse/RPL-1213
- 23402 vdb-entry
- 25004 third-party-advisory