Description
Buffer overflow in (1) X.Org Xserver before 1.4.1, and (2) the libfont and libXfont libraries on some platforms including Sun Solaris, allows context-dependent attackers to execute arbitrary code via a PCF font with a large difference between the last col and first col values in the PCF_BDF_ENCODINGS table.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxfont | 1:1.3.1-2 | — |
| Debian 14 | xorg-server | 2:1.4.1~git20080105-2 | — |
| Debian 13 | libxfont | 1:1.3.1-2 | — |
| Debian 13 | xorg-server | 2:1.4.1~git20080105-2 | — |
| Debian 12 | libxfont | 1:1.3.1-2 | — |
| Debian 12 | xorg-server | 2:1.4.1~git20080105-2 | — |
| Debian 5.0 | xorg-server | 2:1.3.0.0.dfsg-12lenny2 | DTSA-110-1 |
| Debian 4.0 | xorg-server | 2:1.1.1-21etch3 | DSA-1466-2 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | xfree86 | 4.3.0.dfsg.1-14sarge7 | DSA-1466-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | libXfont +1 | 1.2.2-1.0.3.el5_1 | RHSA-2008:0064 |
| RHEL 4 | xorg-x11 +17 | 6.8.2-1.EL.33.0.2 | RHSA-2008:0030 |
| RHEL 3 | XFree86 +29 | 4.3.0-126.EL | RHSA-2008:0029 |
| RHEL 2 | XFree86 +19 | 4.1.0-86.EL | RHSA-2008:0029 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xorg-x11-server | 1.20.13-1.2 | openSUSE-SU-2024:11525-1 |
Advisories 6
- RHSA-2008:0064 Red Hat Security Advisory: libXfont security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0029 Red Hat Security Advisory: XFree86 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0030 Red Hat Security Advisory: xorg-x11 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1466-2 libxfont xfree86 xorg-server - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-110-1 xorg-server - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11525-1 xorg-x11-server-1.20.13-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 28542 third-party-advisory
- 29139 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-077.htm
- 27336 vdb-entry
- ADV-2008-0184 vdb-entry
- 103192 vendor-advisory
- 29622 third-party-advisory
- FEDORA-2008-0831 vendor-advisory
- FEDORA-2008-0794 vendor-advisory
- SUSE-SA:2008:003 vendor-advisory
- SUSE-SR:2008:008 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=428044
- 28500 third-party-advisory
- 28532 third-party-advisory
- 29707 third-party-advisory
- MDVSA-2008:024 vendor-advisory
- 28843 third-party-advisory
- 28540 third-party-advisory
- SSRT080083 vendor-advisory
- 20080130 rPSA-2008-0032-1 xorg-x11 xorg-x11-fonts xorg-x11-tools xorg-x11-xfs mailing-list
- 28544 third-party-advisory
- ADV-2008-0703 vdb-entry
- MDVSA-2008:021 vendor-advisory
- oval:org.mitre.oval:def:10021 vdb-entry signature
- ADV-2008-0924 vdb-entry
- 28718 third-party-advisory
- RHSA-2008:0029 vendor-advisory
- [4.1] 20080208 012: SECURITY FIX: February 8, 2008 vendor-advisory
- 28941 third-party-advisory
- 28592 third-party-advisory
- RHSA-2008:0064 vendor-advisory
- xorg-pcffont-bo(39767) vdb-entry
- 28621 third-party-advisory
- 29420 third-party-advisory
- MDVSA-2008:022 vendor-advisory
- APPLE-SA-2008-03-18 vendor-advisory
- 30161 third-party-advisory
- GLSA-200805-07 vendor-advisory
- RHSA-2008:0030 vendor-advisory
- 28273 third-party-advisory
- VU#203220 third-party-advisory
- 28550 third-party-advisory
- ADV-2008-0497 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2008-038.htm
- JVNDB-2008-001043 third-party-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=204362
- 28885 third-party-advisory
- USN-571-1 vendor-advisory
- GLSA-200804-05 vendor-advisory
- 28535 third-party-advisory
- FEDORA-2008-0891 vendor-advisory
- ADV-2008-3000 vdb-entry
- http://docs.info.apple.com/article.html?artnum=307562
- [xorg] 20080117 X.Org security advisory: multiple vulnerabilities in the X server mailing-list
- http://www14.software.ibm.com/webapp/set2/subscriptions/ijhifoeblist?mode=7&heading=AIX61&path=/200802/SECURITY/20080227/datafile112539&label=AIX%20X%20server%20multiple%20vulnerabilities
- 27352 vdb-entry
- 32545 third-party-advisory
- 1019232 vdb-entry
- https://issues.rpath.com/browse/RPL-2010
- [4.2] 20080208 006: SECURITY FIX: February 8, 2008 vendor-advisory