CVE-2015-1804 Integer overflow in n/a
Remote authenticated users can cause denial of service or execute arbitrary code via a crafted BDF font file due to improper type conversion in libXfont.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2015-1804?
CVE-2015-1804 is a high-severity vulnerability in n/a, published on 20 Mar 2015. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.
Weakness: CWE-189
Which versions are affected by CVE-2015-1804?
It affects 1 product.
Linux distribution packages (17)
xorg-x11-libs SUSE:Linux Enterprise Desktop 11 SP3 | All versions | 7.4-8.26.46.1 |
xorg-x11-libs SUSE:Linux Enterprise Desktop 11 SP4 | All versions | 7.4-8.26.46.1 |
libXfont SUSE:Linux Enterprise Desktop 12 | All versions | 1.4.7-7.1 |
libXfont SUSE:Linux Enterprise Desktop 12 SP1 | All versions | 1.4.7-7.1 |
xorg-x11-libs SUSE:Linux Enterprise Server 11 SP3 | All versions | 7.4-8.26.46.1 |
xorg-x11-libs SUSE:Linux Enterprise Server 11 SP3-TERADATA | All versions | 7.4-8.26.46.1 |
xorg-x11-libs SUSE:Linux Enterprise Server 11 SP4 | All versions | 7.4-8.26.46.1 |
libXfont SUSE:Linux Enterprise Server 12 | All versions | 1.4.7-7.1 |
libXfont SUSE:Linux Enterprise Server 12 SP1 | All versions | 1.4.7-7.1 |
xorg-x11-libs SUSE:Linux Enterprise Server for SAP Applications 11 SP3 | All versions | 7.4-8.26.46.1 |
xorg-x11-libs SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 7.4-8.26.46.1 |
libXfont SUSE:Linux Enterprise Server for SAP Applications 12 | All versions | 1.4.7-7.1 |
libXfont SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 1.4.7-7.1 |
xorg-x11-libs SUSE:Linux Enterprise Software Development Kit 11 SP3 | All versions | 7.4-8.26.46.1 |
xorg-x11-libs SUSE:Linux Enterprise Software Development Kit 11 SP4 | All versions | 7.4-8.26.46.1 |
libXfont SUSE:Linux Enterprise Software Development Kit 12 | All versions | 1.4.7-7.1 |
libXfont SUSE:Linux Enterprise Software Development Kit 12 SP1 | All versions | 1.4.7-7.1 |
Products include X Libxfont.
How do I fix CVE-2015-1804?
Upgrade to a fixed version.
Is CVE-2015-1804 being exploited?
There is no known exploitation of CVE-2015-1804 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2015-1804, GHSA-78q2-gpgm-j9wf, SUSE-RU-2015:2393-1, SUSE-RU-2016:0031-1, UBUNTU-CVE-2015-1804.