Description
The swap_char2b function in X.Org X Font Server (xfs) before 1.0.5 allows context-dependent attackers to execute arbitrary code via (1) QueryXBitmaps and (2) QueryXExtents protocol requests with crafted size values that specify an arbitrary number of bytes to be swapped on the heap, which triggers heap corruption.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | xfs | 1.0.1-7 | DSA-1385-1 |
| Debian 3.1 | xfree86 | 4.3.0.dfsg.1-14sarge5 | DSA-1385-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | xorg-x11 +17 | 6.8.2-1.EL.33.0.2 | RHSA-2008:0030 |
| RHEL 3 | XFree86 +29 | 4.3.0-126.EL | RHSA-2008:0029 |
| RHEL 2 | XFree86 +19 | 4.1.0-86.EL | RHSA-2008:0029 |
Advisories 3
- RHSA-2008:0029 Red Hat Security Advisory: XFree86 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0030 Red Hat Security Advisory: xorg-x11 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1385-1 xfs Debian Security (DSA / DLA) · Mar 9, 2026
References
- SUSE-SA:2007:054 vendor-advisory
- 1018763 vdb-entry
- 28542 third-party-advisory
- 200642 vendor-advisory
- FEDORA-2007-4263 vendor-advisory
- 20071003 rPSA-2007-0205-1 xorg-x11 xorg-x11-fonts xorg-x11-tools xorg-x11-xfs mailing-list
- http://bugs.freedesktop.org/show_bug.cgi?id=12299
- 28514 third-party-advisory
- 27052 third-party-advisory
- 20071002 Multiple Vendor X Font Server Multiple Vulnerabilities third-party-advisory
- 27060 third-party-advisory
- ADV-2008-0924 vdb-entry
- HPSBUX02303 vendor-advisory
- [xorg-announce] 20071002 [ANNOUNCE] X.Org security advisory: multiple vulnerabilities in X font server mailing-list
- RHSA-2008:0029 vendor-advisory
- 28004 third-party-advisory
- 27240 third-party-advisory
- https://issues.rpath.com/browse/RPL-1756
- 29420 third-party-advisory
- 27040 third-party-advisory
- APPLE-SA-2008-03-18 vendor-advisory
- 27176 third-party-advisory
- GLSA-200710-11 vendor-advisory
- 27228 third-party-advisory
- ADV-2007-3467 vdb-entry
- RHSA-2008:0030 vendor-advisory
- 103114 vendor-advisory
- ADV-2008-0149 vdb-entry
- MDKSA-2007:210 vendor-advisory
- 25898 vdb-entry
- http://bugs.gentoo.org/show_bug.cgi?id=194606
- ADV-2007-3338 vdb-entry
- 27560 third-party-advisory
- oval:org.mitre.oval:def:11599 vdb-entry signature
- http://docs.info.apple.com/article.html?artnum=307562
- ADV-2007-3337 vdb-entry
- xfs-queryxbitmaps-queryxextents-bo(36920) vdb-entry
- 28536 third-party-advisory