CVE-2017-16611

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-12-01 · updated 2026-06-17
Weakness: CWE-59

Description

In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 17.04, 17.10
Debian Linux: 8.0, 9.0
X.Org libXfont2: from 1.0.0 before 1.5.4; from 2.0.0 before 2.0.3 — fixed in 1.5.4, 2.0.3

How to fix

Upgrade to a fixed version: X.Org libXfont2 1.5.4, 2.0.3. Check the vendor advisory for mitigations.

References

http://security.cucumberlinux.com/security/details.php?id=155
http://www.openwall.com/lists/oss-security/2017/11/28/7
http://www.ubuntu.com/usn/USN-3500-1
https://bugzilla.suse.com/show_bug.cgi?id=1050459
https://lists.debian.org/debian-lts-announce/2022/01/msg00028.html
https://marc.info/?l=freedesktop-xorg-announce&m=151188044218304&w=2
https://marc.info/?l=freedesktop-xorg-announce&m=151188049718337&w=2
https://security.gentoo.org/glsa/201801-10
http://security.cucumberlinux.com/security/details.php?id=155
http://www.openwall.com/lists/oss-security/2017/11/28/7
http://www.ubuntu.com/usn/USN-3500-1
https://bugzilla.suse.com/show_bug.cgi?id=1050459

Get alerted when CVE-2017-16611 or the next vulnerability affects your stack