GCVE - cpe:2.3:a:x:libxfont:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:x:libxfont:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	X (`a2acdb6f-4f26-543b-8294-d5d6397c9211`)
Product	Libxfont (`67462931-b5b2-55f6-9260-18cb2182eec6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/libxfont`	purl2cpe	2026-06-01 10:12:31.286470
`pkg:deb/ubuntu/libxfont`	purl2cpe	2026-06-01 10:12:31.286472
`pkg:github/freedesktop/libxfont`	purl2cpe	2026-06-01 10:12:31.286474
`pkg:github/freedesktop/xorg-libxfont`	purl2cpe	2026-06-01 10:12:31.286475
`pkg:github/val-verde/libxfont`	purl2cpe	2026-06-01 10:12:31.286477
`pkg:rpm/centos/libxfont`	purl2cpe	2026-06-01 10:12:31.286478
`pkg:rpm/fedora/libxfont`	purl2cpe	2026-06-01 10:12:31.286479
`pkg:rpm/opensuse/libxfont`	purl2cpe	2026-06-01 10:12:31.286481

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-16611`	vulnerable	2026-06-08 05:09:00.641435	Details available In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files. Published: 2017-12-01T17:00:00.000Z Updated: 2024-08-05T20:27:04.463Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2017/11/28/7 https://bugzilla.suse.com/show_bug.cgi?id=1050459 http://www.ubuntu.com/usn/USN-3500-1 https://marc.info/?l=freedesktop-xorg-announce&m=151188044218304&w=2 https://security.gentoo.org/glsa/201801-10	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-1804`	vulnerable	2026-06-08 05:06:26.305919	Details available The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file. Published: 2015-03-20T14:00:00.000Z Updated: 2024-08-06T04:54:16.301Z Open on db.gcve.eu Reference links http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html https://security.gentoo.org/glsa/201507-21 http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00002.html http://lists.opensuse.org/opensuse-updates/2015-12/msg00074.html http://www.ubuntu.com/usn/USN-2536-1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-1803`	vulnerable	2026-06-08 05:06:26.305406	Details available The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly handle character bitmaps it cannot read, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a crafted BDF font file. Published: 2015-03-20T14:00:00.000Z Updated: 2024-08-06T04:54:16.182Z Open on db.gcve.eu Reference links http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html https://security.gentoo.org/glsa/201507-21 http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00002.html http://www.ubuntu.com/usn/USN-2536-1 http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152838.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-1802`	vulnerable	2026-06-08 05:06:26.303882	Details available The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote authenticated users to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a (1) negative or (2) large property count in a BDF font file. Published: 2015-03-20T14:00:00.000Z Updated: 2024-08-06T04:54:16.071Z Open on db.gcve.eu Reference links http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html https://security.gentoo.org/glsa/201507-21 http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00002.html http://www.securityfocus.com/bid/73277 http://www.ubuntu.com/usn/USN-2536-1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0211`	vulnerable	2026-06-08 05:05:12.215699	Details available Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow. Published: 2014-05-15T14:00:00.000Z Updated: 2024-08-06T09:05:39.379Z Open on db.gcve.eu Reference links http://www.vmware.com/security/advisories/VMSA-2014-0012.html http://lists.opensuse.org/opensuse-updates/2014-05/msg00073.html http://www.ubuntu.com/usn/USN-2211-1 http://secunia.com/advisories/59154 http://www.securityfocus.com/archive/1/534161/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0210`	vulnerable	2026-06-08 05:05:12.214461	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0209`	vulnerable	2026-06-08 05:05:12.202824	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2895`	vulnerable	2026-06-08 04:58:09.424185	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.