Description
The init.d script for the X.Org X11 xfs font server on various Linux distributions might allow local users to change the permissions of arbitrary files via a symlink attack on the /tmp/.font-unix temporary file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | xfs | 1:1.0.1-6 | DSA-1342-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | xorg-x11-xfs +1 | 1:1.0.2-4 | RHSA-2007:0520 |
| RHEL 4 | xorg-x11 +17 | 6.8.2-1.EL.19 | RHSA-2007:0519 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- X.Org xorg-x11-xfs 1.0.2-3.1 - Local Race Condition EDB-5167 · local · Feb 21, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2007:0520 Red Hat Security Advisory: xorg-x11-xfs security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0519 Red Hat Security Advisory: xorg-x11 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1342-1 xfs Debian Security (DSA / DLA) · Mar 9, 2026
References
- oval:org.mitre.oval:def:10802 vdb-entry signature
- 35674 third-party-advisory
- 24888 vdb-entry
- RHSA-2007:0520 vendor-advisory
- 26081 third-party-advisory
- DSA-1342 vendor-advisory
- https://issues.rpath.com/browse/RPL-1485
- 27240 third-party-advisory
- 26056 third-party-advisory
- 20070717 rPSA-2007-0141-1 xorg-x11 xorg-x11-fonts xorg-x11-tools xorg-x11-xfs mailing-list
- 5167 exploit
- 1018375 vdb-entry
- GLSA-200710-11 vendor-advisory
- FEDORA-2009-3666 vendor-advisory
- http://bugzilla.redhat.com/242903
- redhat-xfs-privilege-escalation(35375) vdb-entry
- 20070712 Red Hat Enterprise Linux init.d XFS Script chown Race Condition Vulnerability third-party-advisory
- 26282 third-party-advisory
- RHSA-2007:0519 vendor-advisory
- 40945 vdb-entry
- http://bugs.gentoo.org/show_bug.cgi?id=185660
- FEDORA-2009-3651 vendor-advisory