Cloudanix VulnDB

CVE-2015-1802

None

CVSS

—

EPSS

4.9%

Published

Mar 20, 2015

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in handling certain font files can let attackers crash systems or run harmful code if they trick an authorized user into loading a bad font.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Remote Code Execution
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds write in bdfReadProperties triggered by negative or large property counts in BDF font files, resulting in memory corruption that can crash the process or allow arbitrary code execution.

Why it matters to the business

Systems relying on affected X font libraries face risk of denial of service or full compromise when processing untrusted fonts, potentially disrupting graphical sessions and requiring emergency patching across Linux distributions.

How an attack unfolds

An attacker crafts a BDF font file containing a negative or excessively large property count, then supplies it to an authenticated user or process that invokes font loading through the vulnerable libXfont library, causing the bdfReadProperties function to perform an out-of-bounds write that can be leveraged for code execution.

How to fix it

Upgrade libXfont to version 1.4.9 or 1.5.1 (or later) on all affected systems; apply vendor patches for x libxfont, Ubuntu, and Debian packages as soon as available.

How to confirm the fix worked

Verify installed libXfont version is at or above 1.4.9/1.5.1; attempt to load a test BDF font with negative property count in a controlled environment and confirm no crash or corruption occurs.

Typical attack path

  1. Craft malicious BDF font file with invalid property count
  2. Deliver font file to target system via file share, web download, or package
  3. Trigger font parsing through X server or application font handling
  4. Exploit resulting memory corruption for denial of service or code execution

How to detect it

Search X server and application logs for segmentation faults or crashes occurring during BDF font parsing; inspect any processes that load fonts from untrusted sources for unexpected memory errors.

What your security team should do

  • Prioritize patching libXfont across all X11-based systems within 30 days
  • Restrict untrusted font file processing until upgrades are complete
  • Monitor for font-related crashes in X server logs as temporary detection measure

The record

The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote authenticated users to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a (1) negative or (2) large property count in a BDF font file.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 libxfont 0 1:1.5.1-1
Debian:12 libxfont 0 1:1.5.1-1
Debian:13 libxfont 0 1:1.5.1-1
Debian:6.0 libxfont 0 1:1.4.1-5+deb6u1
Debian:7 libxfont 0 1:1.4.5-5
Mageia:4 libxfont 0 1.4.7-1.2.mga4
Red Hat:enterprise_linux:6::client libXfont 0 0:1.4.5-5.el6_7
Red Hat:enterprise_linux:6::client libXfont-debuginfo 0 0:1.4.5-5.el6_7
Red Hat:enterprise_linux:6::client libXfont-devel 0 0:1.4.5-5.el6_7
Red Hat:enterprise_linux:6::computenode libXfont 0 0:1.4.5-5.el6_7
Red Hat:enterprise_linux:6::computenode libXfont-debuginfo 0 0:1.4.5-5.el6_7
Red Hat:enterprise_linux:6::computenode libXfont-devel 0 0:1.4.5-5.el6_7
Red Hat:enterprise_linux:6::server libXfont 0 0:1.4.5-5.el6_7
Red Hat:enterprise_linux:6::server libXfont-debuginfo 0 0:1.4.5-5.el6_7
Red Hat:enterprise_linux:6::server libXfont-devel 0 0:1.4.5-5.el6_7
Red Hat:enterprise_linux:6::workstation libXfont 0 0:1.4.5-5.el6_7
Red Hat:enterprise_linux:6::workstation libXfont-debuginfo 0 0:1.4.5-5.el6_7
Red Hat:enterprise_linux:6::workstation libXfont-devel 0 0:1.4.5-5.el6_7
Red Hat:enterprise_linux:7::client libXfont 0 0:1.4.7-3.el7_1
Red Hat:enterprise_linux:7::client libXfont-debuginfo 0 0:1.4.7-3.el7_1
Red Hat:enterprise_linux:7::client libXfont-devel 0 0:1.4.7-3.el7_1
Red Hat:enterprise_linux:7::computenode libXfont 0 0:1.4.7-3.el7_1
Red Hat:enterprise_linux:7::computenode libXfont-debuginfo 0 0:1.4.7-3.el7_1
Red Hat:enterprise_linux:7::computenode libXfont-devel 0 0:1.4.7-3.el7_1
Red Hat:enterprise_linux:7::server libXfont 0 0:1.4.7-3.ael7b_1
Red Hat:enterprise_linux:7::server libXfont-debuginfo 0 0:1.4.7-3.ael7b_1
Red Hat:enterprise_linux:7::server libXfont-devel 0 0:1.4.7-3.ael7b_1
Red Hat:enterprise_linux:7::workstation libXfont 0 0:1.4.7-3.el7_1
Red Hat:enterprise_linux:7::workstation libXfont-debuginfo 0 0:1.4.7-3.el7_1
Red Hat:enterprise_linux:7::workstation libXfont-devel 0 0:1.4.7-3.el7_1
SUSE:Linux Enterprise Desktop 12 libXfont 0 1.4.7-4.1
SUSE:Linux Enterprise Server 12 libXfont 0 1.4.7-4.1
SUSE:Linux Enterprise Server for SAP Applications 12 libXfont 0 1.4.7-4.1
SUSE:Linux Enterprise Software Development Kit 12 libXfont 0 1.4.7-4.1
Ubuntu:14.04:LTS libxfont 0 1:1.4.7-1ubuntu0.2

Related vulnerabilities