DescriptionIn libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitylow (attack range: local)
Debian Bugs883929

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libxfont (PTS)wheezy1:1.4.5-5vulnerable
wheezy (security)1:1.4.5-5+deb7u1vulnerable
jessie (security), jessie1:1.5.1-1+deb8u1vulnerable
stretch (security), stretch1:2.0.1-3+deb9u1vulnerable
buster, sid1:2.0.1-4vulnerable
libxfont1 (PTS)buster, sid, stretch1:1.5.2-4vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs


[stretch] - libxfont <no-dsa> (Minor issue)
[jessie] - libxfont <no-dsa> (Minor issue)
[wheezy] - libxfont <postponed> (Minor issue)
(for 1.5.x):

Search for package or bug name: Reporting problems