Mageia alert MGASA-2014-0278 (libxfont)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2014-0278: Updated libxfont packages fix security vulnerabilities 
Date:
    	     
 
Fri, 4 Jul 2014 19:52:03 +0200
Message-ID:
    	     
 
<20140704175203.3CE955A07C@valstar.mageia.org>
MGASA-2014-0278 - Updated libxfont packages fix security vulnerabilities

Publication date: 04 Jul 2014
URL: http://advisories.mageia.org/MGASA-2014-0278.html
Type: security
Affected Mageia releases: 3, 4
CVE: CVE-2014-0209,
     CVE-2014-0210,
     CVE-2014-0211

Description:
Ilja van Sprundel discovered that libXfont incorrectly handled font
metadata file parsing. A local attacker could use this issue to cause
libXfont to crash, or possibly execute arbitrary code in order to gain
privileges (CVE-2014-0209).

Ilja van Sprundel discovered that libXfont incorrectly handled X Font
Server replies. A malicious font server could return specially-crafted
data that could cause libXfont to crash, or possibly execute arbitrary
code (CVE-2014-0210, CVE-2014-0211).

References:
- https://bugs.mageia.org/show_bug.cgi?id=13373
- http://www.ubuntu.com/usn/usn-2211-1/
- http://lists.x.org/archives/xorg-announce/2014-May/002431...
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0209
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0210
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0211

SRPMS:
- 4/core/libxfont-1.4.7-1.1.mga4
- 3/core/libxfont-1.4.5-3.2.mga3