Veille CVE

Recherche « X libxfont »

6 CVE

Critique 2 Élevée 4 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « X libxfont » ✕
  1. CVE-2026-59679 9.0 Critique

    SUSE Container suse/kiosk/tigervnc-x11vnc:1.14-63.8 · SUSE Container suse/kiosk/xorg:21.1-83.7 · SUSE Image SLES15-SP6-SAP · SUSE Image SLES15-SP6-SAP-Azure

    fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) in the extents reply, then a large num_chars (e.g. 100000) in the bitmaps reply. This causes attacker-controlled out-of-bounds heap read and writes.

  2. CVE-2026-44950 9.0 Critique

    SUSE Container suse/kiosk/tigervnc-x11vnc:1.14-63.8 · SUSE Container suse/kiosk/xorg:21.1-83.7 · SUSE Image SLES15-SP6-SAP · SUSE Image SLES15-SP6-SAP-Azure

    fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets -- for example 1000 glyphs each referencing {position:0, length:64} with nbytes=64. Each individual source range passes the existing validation, but the cumulative writes total 64000 bytes into a 64-byte destination buffer. This is a heap buffer overflow with attacker-controlled content.

  3. CVE-2026-56003 8.8 Élevée

    X.Org libXfont2 · X libxfont

    A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server.

  4. CVE-2026-56002 8.8 Élevée

    X.Org libXfont2 · X libxfont

    A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8  allows attackers authenticated as X client to execute code within the X server.

  5. CVE-2026-56001 8.8 Élevée

    X.Org libXfont2 · X libxfont

    A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server to execute code within the X server cont

  6. CVE-2026-50256 7.8 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION · Red Hat Enterprise Linux 7 Extended Lifecycle Support

    A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.