PublicDateAtUSN: 2017-10-05
Candidate: CVE-2017-13720
PublicDate: 2017-10-11 17:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13720
 https://ubuntu.com/security/notices/USN-3442-1
Description:
 In the PatternMatch function in fontfile/fontdir.c in libXfont through
 1.5.2 and 2.x before 2.0.2, an attacker with access to an X connection can
 cause a buffer over-read during pattern matching of fonts, leading to
 information disclosure or a crash (denial of service). This occurs because
 '\0' characters are incorrectly skipped in situations involving ?
 characters.
Ubuntu-Description:
Notes:
Bugs:
Priority: low
Discovered-by:
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H [7.1 HIGH]

Patches_libxfont:
 upstream: https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d1e670a4a8704b8708e493ab6155589bcd570608
upstream_libxfont: needs-triage
precise/esm_libxfont: DNE
trusty_libxfont: released (1:1.4.7-1ubuntu0.3)
trusty/esm_libxfont: released (1:1.4.7-1ubuntu0.3)
vivid/ubuntu-core_libxfont: DNE
xenial_libxfont: released (1:1.5.1-1ubuntu0.16.04.3)
esm-infra/xenial_libxfont: released (1:1.5.1-1ubuntu0.16.04.3)
zesty_libxfont: released (1:2.0.1-3ubuntu0.1)
devel_libxfont: released (1:2.0.1-3ubuntu1)

Patches_libxfont1:
upstream_libxfont1: needs-triage
precise/esm_libxfont1: DNE
trusty_libxfont1: DNE
trusty/esm_libxfont1: DNE
vivid/ubuntu-core_libxfont1: DNE
xenial_libxfont1: DNE
zesty_libxfont1: released (1:1.5.2-4ubuntu0.1)
devel_libxfont1: released (1:1.5.2-4ubuntu1)

Patches_libxfont2:
upstream_libxfont2: needs-triage
precise/esm_libxfont2: DNE
trusty_libxfont2: DNE
trusty/esm_libxfont2: DNE
vivid/ubuntu-core_libxfont2: DNE
xenial_libxfont2: released (1:2.0.1-3~ubuntu16.04.2)
esm-infra/xenial_libxfont2: released (1:2.0.1-3~ubuntu16.04.2)
zesty_libxfont2: DNE
devel_libxfont2: DNE