The bdf parser reads a count for the number of properties defined in a font from the font file, and allocates arrays with entries for each property based on that count. It never checked to see if that count was negative, or large enough to overflow when multiplied by the size of the structures being allocated, and could thus allocate the wrong buffer size, leading to out of bounds writes.

A local user could exploit this issue to potentially execute arbitrary code with the privileges of the X.Org server.

Upstream patch:

http://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=2deda9906480f9c8ae07b8c2a5510cc7e4c59a8e

External References:

http://www.x.org/wiki/Development/Security/Advisory-2015-03-17/