Bug 1203715 (CVE-2015-1802)

Summary: CVE-2015-1802 libXfont: missing range check in bdfReadProperties
Product: [Other] Security Response Reporter: Martin Prpič <mprpic>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: btissoir, dominik.mierzejewski, fonts-bugs, sandmann
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: libXfont 1.5.1, libXfont 1.4.9 Doc Type: Bug Fix
Doc Text:
An integer overflow flaw was found in the way libXfont processed certain Glyph Bitmap Distribution Format (BDF) fonts. A malicious, local user could use this flaw to crash the X.Org server or, potentially, execute arbitrary code with the privileges of the X.Org server.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 02:40:08 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1203720, 1258892, 1258893, 1258894, 1258895    
Bug Blocks: 1203722    

Description Martin Prpič 2015-03-19 14:08:08 UTC 
The bdf parser reads a count for the number of properties defined in a font from the font file, and allocates arrays with entries for each property based on that count. It never checked to see if that count was negative, or large enough to overflow when multiplied by the size of the structures being allocated, and could thus allocate the wrong buffer size, leading to out of bounds writes.

A local user could exploit this issue to potentially execute arbitrary code with the privileges of the X.Org server.

Upstream patch:

http://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=2deda9906480f9c8ae07b8c2a5510cc7e4c59a8e

External References:

http://www.x.org/wiki/Development/Security/Advisory-2015-03-17/
Comment 1 Martin Prpič 2015-03-19 14:14:49 UTC 
Created libXfont tracking bugs for this issue:

Affects: fedora-all [bug 1203720]
Comment 2 Fedora Update System 2015-03-23 07:17:11 UTC 
libXfont-1.5.1-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 errata-xmlrpc 2015-09-03 11:26:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 6

Via RHSA-2015:1708 https://rhn.redhat.com/errata/RHSA-2015-1708.html
Comment 5 ddu 2015-09-07 05:07:38 UTC 
Hi guys,

Does this problem CVE affect libXfont shipped with RHEL5?

Best regards,
Dapeng