CVE-2014-0211

Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow.

• canonical ubuntu linux 10.04 • canonical ubuntu linux 12.04 • canonical ubuntu linux 12.10 • canonical ubuntu linux 13.10 • canonical ubuntu linux 14.04 • x libxfont (<= 1.4.7) • x libxfont 1.2.3 • x libxfont 1.2.4 • x libxfont 1.2.5 • x libxfont 1.2.6 • x libxfont 1.2.7 • x libxfont 1.2.8 • x libxfont 1.2.9 • x libxfont 1.3.0 • x libxfont 1.3.1 • x libxfont 1.3.2 • x libxfont 1.3.3 • x libxfont 1.3.4 • x libxfont 1.4.0 • x libxfont 1.4.1 • x libxfont 1.4.2 • x libxfont 1.4.3 • x libxfont 1.4.4 • x libxfont 1.4.5 • x libxfont 1.4.6 • x libxfont 1.4.99