CVE-2013-6462 Memory corruption in n/a

Critical 9.3 Published 9 Jan 2014 Updated 6 Aug 2024

Remote attackers can cause denial of service or execute arbitrary code via a crafted BDF font file in X.Org libXfont.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2013-6462?

CVE-2013-6462 is a critical memory corruption vulnerability in n/a, published on 9 Jan 2014. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Stack-based buffer overflow in the bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont 1.1 through 1.4.6 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in a character name in a BDF font file.

Weakness: CWE-119

Which versions are affected by CVE-2013-6462?

It affects 1 product.

Linux distribution packages (20)

`libXfont` Red Hat:enterprise_linux:5::client	All versions	`0:1.2.2-1.0.5.el5_10`
`libXfont-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:1.2.2-1.0.5.el5_10`
`libXfont` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.2.2-1.0.5.el5_10`
`libXfont-debuginfo` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.2.2-1.0.5.el5_10`
`libXfont-devel` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.2.2-1.0.5.el5_10`
`libXfont` Red Hat:enterprise_linux:5::server	All versions	`0:1.2.2-1.0.5.el5_10`
`libXfont-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:1.2.2-1.0.5.el5_10`
`libXfont-devel` Red Hat:enterprise_linux:5::server	All versions	`0:1.2.2-1.0.5.el5_10`
`libXfont` Red Hat:enterprise_linux:6::client	All versions	`0:1.4.5-3.el6_5`
`libXfont-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`0:1.4.5-3.el6_5`
`libXfont-devel` Red Hat:enterprise_linux:6::client	All versions	`0:1.4.5-3.el6_5`
`libXfont` Red Hat:enterprise_linux:6::computenode	All versions	`0:1.4.5-3.el6_5`
`libXfont-debuginfo` Red Hat:enterprise_linux:6::computenode	All versions	`0:1.4.5-3.el6_5`
`libXfont-devel` Red Hat:enterprise_linux:6::computenode	All versions	`0:1.4.5-3.el6_5`
`libXfont` Red Hat:enterprise_linux:6::server	All versions	`0:1.4.5-3.el6_5`
`libXfont-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:1.4.5-3.el6_5`
`libXfont-devel` Red Hat:enterprise_linux:6::server	All versions	`0:1.4.5-3.el6_5`
`libXfont` Red Hat:enterprise_linux:6::workstation	All versions	`0:1.4.5-3.el6_5`
`libXfont-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`0:1.4.5-3.el6_5`
`libXfont-devel` Red Hat:enterprise_linux:6::workstation	All versions	`0:1.4.5-3.el6_5`

Products include X Libxfont.

How do I fix CVE-2013-6462?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2013-6462 being exploited?

There is no known exploitation of CVE-2013-6462 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2013-6462, DSA-2838-1, GHSA-7vj8-7ww8-h9v6, MGASA-2014-0020, RHSA-2014:0018.