Description
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxfont | 1:1.4.4-1 | — |
| Debian 13 | libxfont | 1:1.4.4-1 | — |
| Debian 12 | libxfont | 1:1.4.4-1 | — |
| Debian 6.0 | libxfont | 1:1.4.1-3 | DSA-2293-1 |
| Debian 5.0 | libxfont | 1:1.3.3-2 | DSA-2293-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | libXfont +1 | 1.4.1-2.el6_1 | RHSA-2011:1154 |
| RHEL 5 | libXfont +1 | 1.2.2-1.0.4.el5_7 | RHSA-2011:1154 |
| RHEL 4 | freetype +3 | 2.1.9-19.el4 | RHSA-2011:1161 |
| RHEL 4 | xorg-x11 +17 | 6.8.2-1.EL.69 | RHSA-2011:1155 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5.6 EUS | libXfont +1 | 1.2.2-1.0.3.el5_6 | RHSA-2011:1834 |
Advisories 5
- RHSA-2011:1154 Red Hat Security Advisory: libXfont security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2011:1161 Red Hat Security Advisory: freetype security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2011:1155 Red Hat Security Advisory: xorg-x11 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2293-1 libxfont - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2011:1834 Red Hat Security Advisory: libXfont security update Red Hat Security Advisories (RHSA) · Mar 3, 2026
References
- https://support.apple.com/HT205635
- RHSA-2011:1154 vendor-advisory
- USN-1191-1 vendor-advisory
- [oss-security] 20110810 LZW decompression issues mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=725760
- 45544 third-party-advisory
- https://support.apple.com/HT205637
- http://support.apple.com/kb/HT5130
- APPLE-SA-2015-12-08-4 vendor-advisory
- MDVSA-2011:153 vendor-advisory
- 49124 vdb-entry
- 45599 third-party-advisory
- RHSA-2011:1155 vendor-advisory
- 1025920 vdb-entry
- openSUSE-SU-2011:1299 vendor-advisory
- APPLE-SA-2015-12-08-3 vendor-advisory
- SUSE-SU-2011:1035 vendor-advisory
- APPLE-SA-2012-02-01-1 vendor-advisory
- [xorg-announce] 20110810 X.Org security advisory: libXfont LZW decompression heap corruption mailing-list
- 46127 third-party-advisory
- 45986 third-party-advisory
- RHSA-2011:1161 vendor-advisory
- RHSA-2011:1834 vendor-advisory
- http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/compress/zopen.c#rev1.17
- xorg-lzw-bo(69141) vdb-entry
- APPLE-SA-2015-12-08-1 vendor-advisory
- 45568 third-party-advisory
- [xorg-announce] 20110810 [ANNOUNCE] libXfont 1.4.4 mailing-list
- https://support.apple.com/HT205641
- NetBSD-SA2011-007 vendor-advisory
- https://support.apple.com/HT205640
- http://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d11ee5886e9d9ec610051a206b135a4cdc1e09a0
- 48951 third-party-advisory
- APPLE-SA-2015-12-08-2 vendor-advisory
- http://support.apple.com/kb/HT5281
- APPLE-SA-2012-05-09-1 vendor-advisory
- DSA-2293 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=727624