---------------------------------------------------------------------- Want to work within IT-Security? Secunia is expanding its team of highly skilled security experts. We will help with relocation and obtaining a work permit. Currently the following type of positions are available: http://secunia.com/quality_assurance_analyst/ http://secunia.com/web_application_security_specialist/ http://secunia.com/hardcore_disassembler_and_reverse_engineer/ ---------------------------------------------------------------------- TITLE: XFree86 CID Encoded Fonts Integer Overflows SECUNIA ADVISORY ID: SA21890 VERIFY ADVISORY: http://secunia.com/advisories/21890/ CRITICAL: Less critical IMPACT: Privilege escalation WHERE: Local system SOFTWARE: XFree86 4.1.x http://secunia.com/product/3012/ XFree86 4.2.x http://secunia.com/product/3011/ XFree86 4.3.x http://secunia.com/product/1131/ XFree86 4.4.x http://secunia.com/product/3510/ XFree86 4.5.x http://secunia.com/product/4870/ XFree86 4.6.x http://secunia.com/product/11386/ DESCRIPTION: Some vulnerabilities have been reported in XFree86, which can be exploited by malicious, local users to gain escalated privileges. Integer overflows exist within the "scan_cidfont()" function when handling CMap and CIDFont data, and the "CIDAFM()" function when parsing AFM (Adobe Font Metric) files. These can potentially be exploited to execute arbitrary code via specially crafted CID encoded Type1 fonts. Successful exploitation may allow to execute arbitrary code with escalated privileges. SOLUTION: Do not load the "type1" font module. PROVIDED AND/OR DISCOVERED BY: Discovered by an anonymous person and reported via iDEFENSE. ORIGINAL ADVISORY: iDEFENSE: http://www.idefense.com/intelligence/vulnerabilities/display.php?id=411 http://www.idefense.com/intelligence/vulnerabilities/display.php?id=412 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------