NVD Vulnerability Detail

CVE-2014-0211

Summary	Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow.
Publication Date	May 15, 2014, 11:55 p.m.
Registration Date	Jan. 26, 2021, 3:04 p.m.
Last Update	Nov. 21, 2024, 11:01 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:13.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:12.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:::::*
cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:::::*

Related information, measures and tools

No	URL	タグ
1	http://advisories.mageia.org/MGASA-2014-0278.html
2	http://advisories.mageia.org/MGASA-2014-0278.html
3	http://lists.opensuse.org/opensuse-updates/2014-05/msg00073.html
4	http://lists.opensuse.org/opensuse-updates/2014-05/msg00073.html
5	http://lists.x.org/archives/xorg-announce/2014-May/002431.html	Vendor Advisory
6	http://lists.x.org/archives/xorg-announce/2014-May/002431.html	Vendor Advisory
7	http://rhn.redhat.com/errata/RHSA-2014-1893.html
8	http://rhn.redhat.com/errata/RHSA-2014-1893.html
9	http://seclists.org/fulldisclosure/2014/Dec/23
10	http://seclists.org/fulldisclosure/2014/Dec/23
11	http://secunia.com/advisories/59154
12	http://secunia.com/advisories/59154
13	http://www.debian.org/security/2014/dsa-2927
14	http://www.debian.org/security/2014/dsa-2927
15	http://www.mandriva.com/security/advisories?name=MDVSA-2015:145
16	http://www.mandriva.com/security/advisories?name=MDVSA-2015:145
17	http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
18	http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
19	http://www.securityfocus.com/archive/1/534161/100/0/threaded
20	http://www.securityfocus.com/archive/1/534161/100/0/threaded
21	http://www.securityfocus.com/bid/67382
22	http://www.securityfocus.com/bid/67382
23	http://www.ubuntu.com/usn/USN-2211-1
24	http://www.ubuntu.com/usn/USN-2211-1
25	http://www.vmware.com/security/advisories/VMSA-2014-0012.html
26	http://www.vmware.com/security/advisories/VMSA-2014-0012.html

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-189	数値処理の問題	https://cwe.mitre.org/data/definitions/189.html

JVN Vulnerability Information

X.Org libXfont における整数オーバーフローの脆弱性

Title	X.Org libXfont における整数オーバーフローの脆弱性
Summary	X.Org libXfont の (1) fs_get_reply、(2) fs_alloc_glyphs、および (3) fs_read_extent_info 関数には、整数オーバーフローの脆弱性が存在します。
Possible impacts	リモートのフォントサーバにより、巧妙に細工された xfs の応答を介して、任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	May 13, 2014, midnight
Registration Date	May 19, 2014, 3:11 p.m.
Last Update	June 26, 2015, 4:23 p.m.

Affected System

オラクル

Oracle Virtualization の Oracle Secure Global Desktop 4.63

Oracle Virtualization の Oracle Secure Global Desktop 4.71

Oracle Virtualization の Oracle Secure Global Desktop 5.0

Oracle Virtualization の Oracle Secure Global Desktop 5.1

X.Org Foundation

libXfont 1.4.8 未満

libXfont 1.4.99.901 未満の 1.4.9x

Canonical

Ubuntu 10.04 LTS

Ubuntu 12.04 LTS

Ubuntu 12.10

Ubuntu 13.10

Ubuntu 14.04 LTS

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-0211	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0211
National Vulnerability Database (NVD)
2	CVE-2014-0211	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0211

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-189	https://jvndb.jvn.jp/ja/cwe/CWE-189.html

ベンダー情報

No	Name	URL
Oracle Critical Patch Update
1	Oracle Critical Patch Update Advisory - July 2014	http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
2	Text Form of Oracle Critical Patch Update - July 2014 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujul2014verbose-1972958.html
Red Hat Security Advisory
3	RHSA-2014:1893	https://rhn.redhat.com/errata/RHSA-2014-1893.html
SECURITY BLOG
4	July 2014 Critical Patch Update Released	https://blogs.oracle.com/security/entry/july_2014_critical_patch_update
5	Multiple vulnerabilities in X.Org	https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_x_org2
Ubuntu Security Notice
6	USN-2211-1	http://www.ubuntu.com/usn/USN-2211-1/
X.Org Security Advisory
7	Multiple issues in libXfont	http://lists.x.org/archives/xorg-announce/2014-May/002431.html

その他

No	Name	URL
関連文書
1	MGASA-2014-0278	http://advisories.mageia.org/MGASA-2014-0278.html

Change Log

No	Changed Details	Date of change
0	[2014年05月19日] 掲載 [2014年07月18日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - July 2014) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - July 2014 Risk Matrices) を追加ベンダ情報：オラクル (July 2014 Critical Patch Update Released) を追加 [2014年07月25日] ベンダ情報：オラクル (Multiple vulnerabilities in X.Org) を追加 [2014年12月08日] ベンダ情報：レッドハット (RHSA-2014:1893) を追加 [2015年06月26日] 参考情報：関連文書 (MGASA-2014-0278) を追加	Feb. 17, 2018, 10:37 a.m.