[security-alerts] FW: [SA21446] XFree86 PCF Integer Overflow Vulnerabilities

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> TITLE:
> XFree86 PCF Integer Overflow Vulnerabilities
> 
> SECUNIA ADVISORY ID:
> SA21446
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/21446/
> 
> CRITICAL:
> Moderately critical
> 
> IMPACT:
> DoS, System access
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> XFree86 4.5.x
> http://secunia.com/product/4870/
> XFree86 4.4.x
> http://secunia.com/product/3510/
> XFree86 4.3.x
> http://secunia.com/product/1131/
> XFree86 4.2.x
> http://secunia.com/product/3011/
> XFree86 4.1.x
> http://secunia.com/product/3012/
> XFree86 4.6.x
> http://secunia.com/product/11386/
> 
> DESCRIPTION:
> A vulnerability has been reported in XFree86, which can be exploited
> by malicious people to cause a DoS (Denial of Service) and
> potentially compromise a vulnerable system.
> 
> The vulnerability is caused due to integer overflows in the PCF font
> parser and can be exploited to crash the X server and potentially
> execute arbitrary code.
> 
> This is related to:
> SA20100
> 
> SOLUTION:
> Do not parse untrusted PCF font files.
> 
> OTHER REFERENCES:
> SA20100:
> http://secunia.com/advisories/20100/
>