CVE-2017-16611

NameCVE-2017-16611
DescriptionIn libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitylow (attack range: local)
Debian Bugs883929

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libxfont (PTS)jessie (security), jessie1:1.5.1-1+deb8u1vulnerable
stretch (security), stretch1:2.0.1-3+deb9u1vulnerable
buster, sid1:2.0.3-1fixed
libxfont1 (PTS)stretch1:1.5.2-4vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libxfontsource(unstable)1:2.0.3-1low883929
libxfont1source(unstable)(unfixed)unimportant

Notes

[stretch] - libxfont <no-dsa> (Minor issue)
[jessie] - libxfont <no-dsa> (Minor issue)
[wheezy] - libxfont <postponed> (Minor issue)
http://www.openwall.com/lists/oss-security/2017/11/28/7
https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=7b377456f95d2ec3ead40f4fb74ea620191f88c8
(for 1.5.x): https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?h=libXfont-1.5-branch&id=5ed8ac0e4f063825b8ecda48e9a111d3ce92e825
https://marc.info/?l=freedesktop-xorg-announce&m=151188049718337&w=2
https://marc.info/?l=freedesktop-xorg-announce&m=151188044218304&w=2

Search for package or bug name: Reporting problems