CVE-2014-0209

Severity: medium (CVSS 4.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-05-15 · updated 2026-06-17
Weakness: CWE-189

Description

Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path, which triggers a heap-based buffer overflow, related to metadata.

Affected products

Canonical Ubuntu Linux: 10.04, 12.04, 12.10, 13.10, 14.04
X.Org libXfont2: through 1.4.7; 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7, 1.2.8 (+14)

References

http://advisories.mageia.org/MGASA-2014-0278.html
http://lists.opensuse.org/opensuse-updates/2014-05/msg00073.html
http://lists.x.org/archives/xorg-announce/2014-May/002431.html
http://rhn.redhat.com/errata/RHSA-2014-1893.html
http://seclists.org/fulldisclosure/2014/Dec/23
http://secunia.com/advisories/59154
http://www.debian.org/security/2014/dsa-2927
http://www.mandriva.com/security/advisories?name=MDVSA-2015:145
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
http://www.securityfocus.com/archive/1/534161/100/0/threaded
http://www.securityfocus.com/bid/67382
http://www.ubuntu.com/usn/USN-2211-1

Get alerted when CVE-2014-0209 or the next vulnerability affects your stack