CVE-2017-13720: High severity red hat libxfont vulnerability
In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with access to an X connection can cause a buffer over-read during pattern matching of fonts, leading to information disclosure or a crash (denial of service). This occurs because '\0' characters are incorrectly skipped in situations involving ? characters.
Other sources
It was discovered that libXfont incorrectly handled certain patterns in PatternMatch. A local attacker could use this issue to cause libXfont to crash, resulting in a denial of service, or possibly obtain sensitive information.
Upstream patch:
https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d1e670a4a8704b8708e493ab6155589bcd570608
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-13720?
CVE-2017-13720 has a severity rating that indicates it can lead to information disclosure or a denial of service.
How do I fix CVE-2017-13720?
To fix CVE-2017-13720, upgrade to libXfont version 2.0.2 or later.
Who is affected by CVE-2017-13720?
CVE-2017-13720 affects users of libXfont versions up to 1.5.2 and specific versions 2.0.0 and 2.0.1.
What type of vulnerability is CVE-2017-13720?
CVE-2017-13720 is a buffer over-read vulnerability that could allow an attacker to exploit information disclosure.
What components are involved in CVE-2017-13720?
CVE-2017-13720 involves the PatternMatch function in fontfile/fontdir.c of the libXfont library.