CVE-2011-2895

CVSS V2 High 9.3 CVSS V3 None
Description
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.
Overview
  • CVE ID
  • CVE-2011-2895
  • Assigner
  • secalert@redhat.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2011-08-19T17:55:03
  • Last Modified Date
  • 2017-08-29T01:29:51
Weakness Enumerations
CWE URL
CWE-119 http://cwe.mitre.org/data/definitions/119.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:freetype:freetype:2.1.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:x:libxfont:*:*:*:*:*:*:*:* 1 OR 1.4.3
cpe:2.3:a:x:libxfont:1.2.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:x:libxfont:1.2.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:x:libxfont:1.2.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:x:libxfont:1.2.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:x:libxfont:1.2.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:x:libxfont:1.2.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:x:libxfont:1.2.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:x:libxfont:1.2.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:x:libxfont:1.2.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:x:libxfont:1.2.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:x:libxfont:1.3.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:x:libxfont:1.3.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:x:libxfont:1.3.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:x:libxfont:1.3.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:x:libxfont:1.3.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:x:libxfont:1.4.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:x:libxfont:1.4.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:x:libxfont:1.4.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:netbsd:netbsd:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:* 1 OR 3.7
cpe:2.3:o:openbsd:openbsd:2.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:openbsd:openbsd:2.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:openbsd:openbsd:2.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:openbsd:openbsd:2.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:openbsd:openbsd:2.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:openbsd:openbsd:2.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:openbsd:openbsd:2.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:openbsd:openbsd:2.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:openbsd:openbsd:2.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:openbsd:openbsd:2.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:openbsd:openbsd:3.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:openbsd:openbsd:3.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:openbsd:openbsd:3.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:openbsd:openbsd:3.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:openbsd:openbsd:3.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:openbsd:openbsd:3.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:openbsd:openbsd:3.6:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:C/I:C/A:C
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • COMPLETE
  • Integrity Impact
  • COMPLETE
  • Availability Impact
  • COMPLETE
  • Base Score
  • 9.3
  • Severity
  • HIGH
  • Exploitability Score
  • 8.6
  • Impact Score
  • 10
References
Reference URL Reference Tags
http://www.ubuntu.com/usn/USN-1191-1
http://lists.freedesktop.org/archives/xorg-announce/2011-August/001721.html Patch
http://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d11ee5886e9d9ec610051a206b135a4cdc1e09a0 Patch
https://bugzilla.redhat.com/show_bug.cgi?id=725760 Patch
http://www.redhat.com/support/errata/RHSA-2011-1155.html Vendor Advisory
http://secunia.com/advisories/45568 Vendor Advisory
http://www.openwall.com/lists/oss-security/2011/08/10/10
http://securitytracker.com/id?1025920
http://www.debian.org/security/2011/dsa-2293
http://secunia.com/advisories/45544 Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2011-1154.html Vendor Advisory
http://www.securityfocus.com/bid/49124
http://secunia.com/advisories/45599 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=727624
http://lists.freedesktop.org/archives/xorg-announce/2011-August/001722.html Patch
http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/compress/zopen.c#rev1.17
http://www.redhat.com/support/errata/RHSA-2011-1161.html Vendor Advisory
http://secunia.com/advisories/45986
http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00019.html
http://secunia.com/advisories/46127
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2011-007.txt.asc
http://www.mandriva.com/security/advisories?name=MDVSA-2011:153
http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00004.html
http://www.redhat.com/support/errata/RHSA-2011-1834.html
http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
http://support.apple.com/kb/HT5130
http://support.apple.com/kb/HT5281
http://lists.apple.com/archives/security-announce/2012/May/msg00001.html
http://secunia.com/advisories/48951
https://support.apple.com/HT205635
http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html
https://support.apple.com/HT205637
http://lists.apple.com/archives/security-announce/2015/Dec/msg00002.html
http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html
https://support.apple.com/HT205641
http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html
https://support.apple.com/HT205640
https://exchange.xforce.ibmcloud.com/vulnerabilities/69141
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2011-2895
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2895
History
Created Old Value New Value Data Type Notes
2022-05-10 08:52:56 Added to TrackCVE