Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 13

Export CSV
CVE-2026-56001

libXfont2 BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow

A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server to execute code within the X server cont

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
X X.org
Products
Libxfont Libxfont
CVE-2026-56002

libXfont2 PCF Font Parsing Heap Buffer Overflow

A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8  allows attackers authenticated as X client to execute code within the X server.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
X X.org
Products
Libxfont Libxfont Libxfont2
CVE-2026-56003

libXfont2 computeProps Property Buffer Heap Buffer Overflow

A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
X X.org
Products
Libxfont Libxfont Libxfont2
CVE-2007-5199

libxfont: single byte overflow in catalogue.c

A single byte overflow in catalogue.c in X.Org libXfont 1.3.1 allows remote attackers to have unspecified impact.

CVSS 3.1 · 9.8 Critical EPSS 2.2% KEV · Not listed
Vendors
X
Products
Libxfont
CVE-2017-16611

libXfont: User can trigger arbitrary file read by X server causing a DoS

In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian X
Products
Ubuntu Linux Debian Linux Libxfont
CVE-2014-0211

libXfont: integer overflows calculating memory needs for xfs replies

Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow.

CVSS 2.0 · 7.5 High EPSS 4.4% KEV · Not listed
Vendors
Canonical Redhat X
Products
Ubuntu Linux Enterprise Linux Libxfont
CVE-2015-1802

libXfont: missing range check in bdfReadProperties

The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote authenticated users to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a (1) negative or (2) large property count in a BDF font file.

CVSS 2.0 · 8.5 High EPSS 4.9% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 1 more
CVE-2015-1803

libXfont: crash on invalid read in bdfReadCharacters

The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly handle character bitmaps it cannot read, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a crafted BDF font file.

CVSS 2.0 · 8.5 High EPSS 4.9% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 1 more
CVE-2015-1804

libXfont: out-of-bounds memory access in bdfReadCharacters

The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.

CVSS 2.0 · 8.5 High EPSS 4.9% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 1 more
CVE-2014-0209

libXfont: integer overflow of allocations in font metadata file parsing

Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path, which triggers a heap-based buffer overflow, related to metadata.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Redhat X
Products
Ubuntu Linux Enterprise Linux Libxfont
CVE-2014-0210

libXfont: unvalidated length fields when parsing xfs protocol replies

Multiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs protocol reply to the (1) _fs_recv_conn_setup, (2) fs_read_open_font, (3) fs_read_query_info, (4) fs_read_extent_info, (5) fs_read_glyphs, (6) fs_read_list, or (7) fs_read_list_info function.

CVSS 2.0 · 7.5 High EPSS 4.6% KEV · Not listed
Vendors
Canonical Redhat X
Products
Ubuntu Linux Enterprise Linux Libxfont
CVE-2011-2895

BSD compress LZW decoder buffer overflow

The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.

CVSS 2.0 · 9.3 Critical EPSS 8.4% KEV · Not listed
Vendors
Freebsd Freetype Netbsd and 3 more
Products
Freebsd Freetype Netbsd and 4 more
CVE-2013-6462

libXfont: stack-based buffer overflow flaw when parsing Glyph Bitmap Distribution Format (BDF) fonts

Stack-based buffer overflow in the bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont 1.1 through 1.4.6 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in a character name in a BDF font file.

CVSS 2.0 · 9.3 Critical EPSS 10.3% KEV · Not listed
Vendors
Redhat X
Products
Enterprise Linux Libxfont