Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap data into a single    allbits buffer allocated to rep->nbytes bytes. The per-glyph validation checks only that each source slice (position, length) lies within the source bitmap buffer, but never checks whether the cumulative destination writes exceed the allocation. A malicious font server can send overlapping source offsets (e.g. 1000 glyphs each referencing {position:0, length:64} with nbytes=64) so that each individual source range passes validation, but the cumulative writes total 64000 bytes into a 64-byte heap buffer. This is a heap buffer overflow with attacker-controlled content and size. When the X server runs as root, this can lead to privilege escalation. When it runs as an unprivileged user, this results in a denial of service (crash).

    This is caused by an incomplete fix of CVE-2014-0210.