User: Password:
|
|
Subscribe / Log in / New account

Mageia alert MGASA-2014-0278 (libxfont)

From:  Mageia Updates <buildsystem-daemon@mageia.org>
To:  updates-announce@ml.mageia.org
Subject:  [updates-announce] MGASA-2014-0278: Updated libxfont packages fix security vulnerabilities
Date:  Fri, 4 Jul 2014 19:52:03 +0200
Message-ID:  <20140704175203.3CE955A07C@valstar.mageia.org>

MGASA-2014-0278 - Updated libxfont packages fix security vulnerabilities Publication date: 04 Jul 2014 URL: http://advisories.mageia.org/MGASA-2014-0278.html Type: security Affected Mageia releases: 3, 4 CVE: CVE-2014-0209, CVE-2014-0210, CVE-2014-0211 Description: Ilja van Sprundel discovered that libXfont incorrectly handled font metadata file parsing. A local attacker could use this issue to cause libXfont to crash, or possibly execute arbitrary code in order to gain privileges (CVE-2014-0209). Ilja van Sprundel discovered that libXfont incorrectly handled X Font Server replies. A malicious font server could return specially-crafted data that could cause libXfont to crash, or possibly execute arbitrary code (CVE-2014-0210, CVE-2014-0211). References: - https://bugs.mageia.org/show_bug.cgi?id=13373 - http://www.ubuntu.com/usn/usn-2211-1/ - http://lists.x.org/archives/xorg-announce/2014-May/002431... - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0209 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0210 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0211 SRPMS: - 4/core/libxfont-1.4.7-1.1.mga4 - 3/core/libxfont-1.4.5-3.2.mga3


(Log in to post comments)


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds