Description: Some vulnerabilities have been reported in libXfont, which can be exploited by malicious, local users to gain escalated privileges.
The vulnerabilities are caused due to integer overflows within the "scan_cid()" function when handling CMAP and CIDFont data and the "CIDADM()" function when parsing AFM (Adobe Font Metric) files. These can be exploited to cause buffer overflows via specially crafted CID encoded Type1 fonts.
Successful exploitation may allow execution of arbitrary code with escalated privileges, but requires access to the "xset fp+" command or similar.
The vulnerabilities have been reported in X11 X.Org 6.7.0. through 7.1.
Solution: Update to libXfont 1.2.2 or apply patches.
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
