NVD Vulnerability Detail

CVE-2014-0210

Summary	Multiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs protocol reply to the (1) _fs_recv_conn_setup, (2) fs_read_open_font, (3) fs_read_query_info, (4) fs_read_extent_info, (5) fs_read_glyphs, (6) fs_read_list, or (7) fs_read_list_info function.
Publication Date	May 15, 2014, 11:55 p.m.
Registration Date	Jan. 26, 2021, 3:04 p.m.
Last Update	Nov. 21, 2024, 11:01 a.m.

Affected software configurations

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:13.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:12.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:::::*
cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:::::*

Related information, measures and tools

No	URL	タグ
1	http://advisories.mageia.org/MGASA-2014-0278.html
2	http://advisories.mageia.org/MGASA-2014-0278.html
3	http://lists.opensuse.org/opensuse-updates/2014-05/msg00073.html
4	http://lists.opensuse.org/opensuse-updates/2014-05/msg00073.html
5	http://lists.x.org/archives/xorg-announce/2014-May/002431.html	Vendor Advisory
6	http://lists.x.org/archives/xorg-announce/2014-May/002431.html	Vendor Advisory
7	http://rhn.redhat.com/errata/RHSA-2014-1893.html
8	http://rhn.redhat.com/errata/RHSA-2014-1893.html
9	http://seclists.org/fulldisclosure/2014/Dec/23
10	http://seclists.org/fulldisclosure/2014/Dec/23
11	http://secunia.com/advisories/59154
12	http://secunia.com/advisories/59154
13	http://www.debian.org/security/2014/dsa-2927
14	http://www.debian.org/security/2014/dsa-2927
15	http://www.mandriva.com/security/advisories?name=MDVSA-2015:145
16	http://www.mandriva.com/security/advisories?name=MDVSA-2015:145
17	http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
18	http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
19	http://www.securityfocus.com/archive/1/534161/100/0/threaded
20	http://www.securityfocus.com/archive/1/534161/100/0/threaded
21	http://www.securityfocus.com/bid/67382
22	http://www.securityfocus.com/bid/67382
23	http://www.ubuntu.com/usn/USN-2211-1
24	http://www.ubuntu.com/usn/USN-2211-1
25	http://www.vmware.com/security/advisories/VMSA-2014-0012.html
26	http://www.vmware.com/security/advisories/VMSA-2014-0012.html

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

JVN Vulnerability Information

X.Org libXfont におけるバッファオーバーフローの脆弱性

Title	X.Org libXfont におけるバッファオーバーフローの脆弱性
Summary	X.Org libXfont には、バッファオーバーフローの脆弱性が存在します。
Possible impacts	リモートのフォントサーバにより、下記の関数に対する巧妙に細工された xfs プロトコルの応答を介して、任意のコードを実行される可能性があります。 (1) _fs_recv_conn_setup 関数 (2) fs_read_open_font 関数 (3) fs_read_query_info 関数 (4) fs_read_extent_info 関数 (5) fs_read_glyphs 関数 (6) fs_read_list 関数 (7) fs_read_list_info 関数
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	May 13, 2014, midnight
Registration Date	May 19, 2014, 3:11 p.m.
Last Update	June 26, 2015, 4:23 p.m.

Affected System

オラクル

Oracle Virtualization の Oracle Secure Global Desktop 4.63

Oracle Virtualization の Oracle Secure Global Desktop 4.71

Oracle Virtualization の Oracle Secure Global Desktop 5.0

Oracle Virtualization の Oracle Secure Global Desktop 5.1

X.Org Foundation

libXfont 1.4.8 未満

libXfont 1.4.99.901 未満の 1.4.9x

Canonical

Ubuntu 10.04 LTS

Ubuntu 12.04 LTS

Ubuntu 12.10

Ubuntu 13.10

Ubuntu 14.04 LTS

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-0210	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0210
National Vulnerability Database (NVD)
2	CVE-2014-0210	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0210

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
Oracle Critical Patch Update
1	Oracle Critical Patch Update Advisory - July 2014	http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
2	Text Form of Oracle Critical Patch Update - July 2014 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujul2014verbose-1972958.html
Red Hat Security Advisory
3	RHSA-2014:1893	https://rhn.redhat.com/errata/RHSA-2014-1893.html
SECURITY BLOG
4	Multiple vulnerabilities in X.Org	https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_x_org2
Ubuntu Security Notice
5	USN-2211-1	http://www.ubuntu.com/usn/USN-2211-1/
X.Org Security Advisory
6	Multiple issues in libXfont	http://lists.x.org/archives/xorg-announce/2014-May/002431.html

その他

No	Name	URL
関連文書
1	MGASA-2014-0278	http://advisories.mageia.org/MGASA-2014-0278.html

Change Log

No	Changed Details	Date of change
0	[2014年05月19日] 掲載 [2014年07月25日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - July 2014) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - July 2014 Risk Matrices) を追加ベンダ情報：オラクル (Multiple vulnerabilities in X.Org) を追加 [2014年12月08日] ベンダ情報：レッドハット (RHSA-2014:1893) を追加 [2015年06月26日] 参考情報：関連文書 (MGASA-2014-0278) を追加	Feb. 17, 2018, 10:37 a.m.