ID |
CVE-2017-13720
|
Sažetak |
In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with access to an X connection can cause a buffer over-read during pattern matching of fonts, leading to information disclosure or a crash (denial of service). This occurs because '\0' characters are incorrectly skipped in situations involving ? characters. |
Reference |
|
CVSS |
Base: | 3.6 |
Impact: | 4.9 |
Exploitability: | 3.9 |
|
Pristup |
Vektor | Složenost | Autentikacija |
LOCAL |
LOW |
NONE |
|
Impact |
Povjerljivost | Cjelovitost | Dostupnost |
PARTIAL |
NONE |
PARTIAL |
|
CVSS vektor |
AV:L/AC:L/Au:N/C:P/I:N/A:P |
Zadnje važnije ažuriranje |
13-11-2017 - 02:29 |
Objavljeno |
11-10-2017 - 17:29 |