Debian Security Advisory DSA 360-1 (xfstt)

Information

Severity

Severity

High

Family

Family

Debian Local Security Checks

CVSSv2 Base

CVSSv2 Base

7.5

CVSSv2 Vector

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Solution Type

Solution Type

Vendor Patch

Created

Created

14 years ago

Modified

Modified

4 years ago

Summary

The remote host is missing an update to xfstt announced via advisory DSA 360-1.

Insight

Insight

xfstt, a TrueType font server for the X window system was found to contain two classes of vulnerabilities: - - CVE-2003-0581: a remote attacker could send requests crafted to trigger any of several buffer overruns, causing a denial of service or possibly executing arbitrary code on the server with the privileges of the 'nobody' user. - - CVE-2003-0625: certain invalid data sent during the connection handshake could allow a remote attacker to read certain regions of memory belonging to the xfstt process. This information could be used for fingerprinting, or to aid in exploitation of a different vulnerability. For the current stable distribution (woody) these problems have been fixed in version 1.2.1-3. For the unstable distribution (sid), CVE-2003-0581 is fixed in xfstt 1.5-1, and CVE-2003-0625 will be fixed soon. We recommend that you update your xfstt package.

Solution

Solution

https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20360-1

Common Vulnerabilities and Exposures (CVE)

Free Vulnerability Scanner

Mageni can help you to scan, assess and manage your vulnerabilities.

Processing. Please wait...

We care about the protection of your data. Read our Privacy Policy.