CVE-2017-16611

NameCVE-2017-16611
DescriptionIn libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2901-1
Debian Bugs883929

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libxfont (PTS)bullseye1:2.0.4-1fixed
sid, trixie, bookworm1:2.0.6-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libxfontsourcestretch1:2.0.1-3+deb9u2DLA-2901-1
libxfontsource(unstable)1:2.0.3-1low883929
libxfont1source(unstable)(unfixed)unimportant

Notes

[jessie] - libxfont <no-dsa> (Minor issue)
[wheezy] - libxfont <postponed> (Minor issue)
https://www.openwall.com/lists/oss-security/2017/11/28/7
https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=7b377456f95d2ec3ead40f4fb74ea620191f88c8
(for 1.5.x): https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?h=libXfont-1.5-branch&id=5ed8ac0e4f063825b8ecda48e9a111d3ce92e825
https://marc.info/?l=freedesktop-xorg-announce&m=151188049718337&w=2
https://marc.info/?l=freedesktop-xorg-announce&m=151188044218304&w=2

Search for package or bug name: Reporting problems