CVE-2017-13720 Information disclosure in n/a
An attacker with X connection access can trigger a buffer over-read in libXfont, leading to information disclosure or a crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-13720?
CVE-2017-13720 is a high-severity vulnerability in n/a, published on 11 Oct 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with access to an X connection can cause a buffer over-read during pattern matching of fonts, leading to information disclosure or a crash (denial of service). This occurs because '\0' characters are incorrectly skipped in situations involving ? characters.
Weakness: CWE-125
Which versions are affected by CVE-2017-13720?
It affects 1 product.
Products include X.org Libxfont.
How do I fix CVE-2017-13720?
Upgrade to a fixed version.
Is CVE-2017-13720 being exploited?
There is no known exploitation of CVE-2017-13720 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2017-13720, GHSA-jrrp-87j9-7387, UBUNTU-CVE-2017-13720.