Bug 114905

Summary:	CAN-2004-0083, CAN-2004-0084, CAN-2004-0106 - XFree86 font.alias buffer overflow
Product:	[Fedora] Fedora	Reporter:	Mark J. Cox <mjc>
Component:	XFree86	Assignee:	Mike A. Harris <mharris>
Status:	CLOSED ERRATA	QA Contact:	David Lawrence <dkl>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	1	CC:	leonard-rh-bugzilla
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2004-02-14 04:28:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Mark J. Cox 2004-02-04 10:19:03 UTC

Reported to Red Hat by XFree86 on 2004Feb03 via
iDefense.  

A malicious user may craft a malformed 'font.alias' file causing a
buffer overflow upon parsing, which could lead to execution of
arbitrary code as root on the server.

Embargoed.  No date for public notification set; CVE applied for.

Patch available.  Errata in progress.

Comment 1 Mark J. Cox 2004-02-06 10:09:16 UTC

http://bugzilla.redhat.com/bugzilla/process_bug.cgi

Comment 2 Mike A. Harris 2004-02-07 10:24:59 UTC

XFree86-4.3.0-49 built for Fedora Core 1 now

Comment 3 Mark J. Cox 2004-02-12 13:12:13 UTC

Subsequently, iDefense found another issue in the same routine with
the same consequences which has been given CVE name CAN-2004-0083.

Additionally David Dawes discovered additional flaws in reading font
files. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0106 to these issues.

Comment 4 Mike A. Harris 2004-02-13 18:26:52 UTC

The XFree86 4.3.0-55 update for Fedora Core 1, fixes all of the
security issues outlined in the CVE (Common Vulnerabilities and
Exposures) advisories: CAN-2004-0083, CAN-2004-0084, and
CAN-2004-0106.

All users are urged to upgrade to this latest update.

Comment 5 Mike A. Harris 2004-02-14 06:43:16 UTC

*** Bug 115569 has been marked as a duplicate of this bug. ***