[Forgot Password]
Login  Register Subscribe

24003

 
 

131425

 
 

103942

 
 

909

 
 

84057

 
 

133

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML view JSON

CVE-2011-2895Date: (C)2011-08-19   (M)2018-01-10


The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V3 Severity:CVSS V2 Severity:
CVSS Score : CVSS Score : 9.3
Exploit Score: Exploit Score: 8.6
Impact Score: Impact Score: 10.0
 
CVSS V3 Metrics:CVSS V2 Metrics:
Attack Vector: Access Vector: NETWORK
Attack Complexity: Access Complexity: MEDIUM
Privileges Required: Authentication: NONE
User Interaction: Confidentiality: COMPLETE
Scope: Integrity: COMPLETE
Confidentiality: Availability: COMPLETE
Integrity:  
Availability:  
  
Reference:
SECTRACK-1025920
SECUNIA-45544
SECUNIA-45568
SECUNIA-45599
SECUNIA-45986
SECUNIA-46127
SECUNIA-48951
BID-49124
APPLE-SA-2012-02-01-1
APPLE-SA-2012-05-09-1
APPLE-SA-2015-12-08-1
APPLE-SA-2015-12-08-2
APPLE-SA-2015-12-08-3
APPLE-SA-2015-12-08-4
DSA-2293
MDVSA-2011:153
NetBSD-SA2011-007
RHSA-2011:1154
RHSA-2011:1155
RHSA-2011:1161
RHSA-2011:1834
SUSE-SU-2011:1035
USN-1191-1
http://www.openwall.com/lists/oss-security/2011/08/10/10
http://lists.freedesktop.org/archives/xorg-announce/2011-August/001721.html
http://lists.freedesktop.org/archives/xorg-announce/2011-August/001722.html
http://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d11ee5886e9d9ec610051a206b135a4cdc1e09a0
http://support.apple.com/kb/HT5130
http://support.apple.com/kb/HT5281
http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/compress/zopen.c#rev1.17
https://bugzilla.redhat.com/show_bug.cgi?id=725760
https://bugzilla.redhat.com/show_bug.cgi?id=727624
https://support.apple.com/HT205635
https://support.apple.com/HT205637
https://support.apple.com/HT205640
https://support.apple.com/HT205641
openSUSE-SU-2011:1299
xorg-lzw-bo(69141)

CPE    40
cpe:/o:openbsd:openbsd:2.3
cpe:/o:openbsd:openbsd:2.2
cpe:/o:openbsd:openbsd:2.5
cpe:/o:openbsd:openbsd:2.4
...
CWE    1
CWE-119
OVAL    21
oval:org.secpod.oval:def:301087
oval:org.secpod.oval:def:400329
oval:org.secpod.oval:def:500253
oval:org.secpod.oval:def:500182
...

© 2013 SecPod Technologies