REDHAT-BUG-2496642: High severity X.Org libXfont2 vulnerability
In libXfont2's ComputeScaledProperties() function, a fixed-size property buffer of 70 slots (1120 bytes) is allocated. The source font properties then trigger a write of 1 slot per unscaled match or 2 slots per scaledX/scaledY match, with no bounds check against the buffer capacity. The PCF parser does not deduplicate properties, so a malicious font can include arbitrarily many properties with the same name atom (e.g. 40 duplicate MINSPACE entries), exceeding the property buffer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2496642?
The severity of REDHAT-BUG-2496642 is rated as high with a score of 7.
What type of vulnerability is REDHAT-BUG-2496642?
REDHAT-BUG-2496642 is a buffer overflow vulnerability in the libXfont2 library.
How do I fix REDHAT-BUG-2496642?
To fix REDHAT-BUG-2496642, you should update the X.Org libXfont2 package to the latest version that addresses this vulnerability.
What are the potential impacts of REDHAT-BUG-2496642?
The potential impacts of REDHAT-BUG-2496642 include application crashes and possible arbitrary code execution due to the buffer overflow.
Is my system at risk due to REDHAT-BUG-2496642?
If you are using a vulnerable version of the X.Org libXfont2 library, your system may be at risk due to REDHAT-BUG-2496642.