Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
X.Org libXfont LZW解压缩本地权限提升漏洞
Vulnerability Description
X.Org是X.Org基金会运作的一个对X Window系统的官方参考实现，是开源的自由软件。 X.Org libXfont库在基于源BSD压缩代码的压缩/LZW解压器的实现的过程中没有正确处理包含尚未添加到解压表的代码字的压缩流。当码字匹配解压表中首次释放的条目时，LZW解压会存在特殊情况(KwKwK字符串)。libXfont中的实现可允许码字不仅匹配而且超过首个释放的条目，导致基于堆的缓冲区溢出。
CVSS Information
N/A
Vulnerability Type
N/A