Vulnetix
Try Vulnetix Request Demo
CVE-2017-13720 PUBLISHED

In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with access to an X connection can cause a buffer over-read during pattern matching of fonts, leading to information disclosure or a crash (denial of service). This occurs because '\0' characters are incorrectly skipped in situations involving ? characters.

EPSS 0.10% · 28.1th percentile

Risk Scores

EPSS Score
0.10%
28.1th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSlibxfont0, 1:1.5.1-1, 1:1.5.1-1ubuntu0.16.04.1
Ubuntu:14.04:LTSlibxfont1:1.4.7-1ubuntu0.1, 1:1.4.7-1ubuntu0.2, 0
Ubuntu:16.04:LTSlibxfont20, 1:2.0.1-3~ubuntu16.04.1

Timeline

References

Open in Interactive Console →