Ubuntu Security Notice 2211-1 - Ilja van Sprundel discovered that libXfont incorrectly handled font metadata file parsing. A local attacker could use this issue to cause libXfont to crash, or possibly execute arbitrary code in order to gain privileges. Ilja van Sprundel discovered that libXfont incorrectly handled X Font Server replies. A malicious font server could return specially-crafted data that could cause libXfont to crash, or possibly execute arbitrary code. This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS, Ubuntu 12.10 and Ubuntu 13.10. Various other issues were also addressed.
0bbf8ea90bc59f76ed3140c2991e87eeb3a271aa7e0d9baa9cb00269fe2e309a
============================================================================
Ubuntu Security Notice USN-2211-1
May 14, 2014
libxfont vulnerabilities
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 13.10
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in libXfont.
Software Description:
- libxfont: X11 font rasterisation library
Details:
Ilja van Sprundel discovered that libXfont incorrectly handled font
metadata file parsing. A local attacker could use this issue to cause
libXfont to crash, or possibly execute arbitrary code in order to gain
privileges. (CVE-2014-0209)
Ilja van Sprundel discovered that libXfont incorrectly handled X Font
Server replies. A malicious font server could return specially-crafted data
that could cause libXfont to crash, or possibly execute arbitrary code.
This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS, Ubuntu 12.10
and Ubuntu 13.10. (CVE-2014-0210, CVE-2014-0211)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
libxfont1 1:1.4.7-1ubuntu0.1
Ubuntu 13.10:
libxfont1 1:1.4.6-1ubuntu0.2
Ubuntu 12.10:
libxfont1 1:1.4.5-2ubuntu0.12.10.2
Ubuntu 12.04 LTS:
libxfont1 1:1.4.4-1ubuntu0.2
Ubuntu 10.04 LTS:
libxfont1 1:1.4.1-1ubuntu0.3
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2211-1
CVE-2014-0209, CVE-2014-0210, CVE-2014-0211
Package Information:
https://launchpad.net/ubuntu/+source/libxfont/1:1.4.7-1ubuntu0.1
https://launchpad.net/ubuntu/+source/libxfont/1:1.4.6-1ubuntu0.2
https://launchpad.net/ubuntu/+source/libxfont/1:1.4.5-2ubuntu0.12.10.2
https://launchpad.net/ubuntu/+source/libxfont/1:1.4.4-1ubuntu0.2
https://launchpad.net/ubuntu/+source/libxfont/1:1.4.1-1ubuntu0.3