Privilege escalation in libXfont - CVE-2017-16611

Vulnerability identifier: #VU9524

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-16611

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to improper privileges control. A local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files.

libXfont
Gentoo Linux
Slackware Linux
Ubuntu
Fedora
libxfont (Alpine package)
libxfont2 (Alpine package)
libxfont (Ubuntu package)
libXfont
libXfont2

Update to version 1.5.4 or 2.0.3.

libxfont (Alpine package) - addressed in versions 1.5.2-r1, 1.5.4-r0
libxfont2 (Alpine package) - update to 2.0.3-r0
libxfont (Ubuntu package) - addressed in versions 1:1.4.7-1ubuntu0.4+esm2, 1:1.5.1-1ubuntu0.16.04.4+esm2, 1:2.0.3-1ubuntu0.1~esm2, 1:2.0.3-1ubuntu0.20.04.1~esm2, 1:2.0.5-1ubuntu0.2, 1:2.0.6-1+deb13u1build0.24.04.2, 1:2.0.6-2ubuntu0.2
libXfont - addressed in versions 1.5.4-1.fc26, 1.5.4-1.fc27
libXfont2 - addressed in versions 2.0.3-1.fc26, 2.0.3-1.fc27

• https://marc.info/?l=freedesktop-xorg-announce&m=151188049718337&w=2
• https://marc.info/?l=freedesktop-xorg-announce&m=151188044218304&w=2

• Ubuntu update for libXfont
• Slackware Linux update for libXfont
• Privilege escalation in libxfont
• Gentoo update for LibXfont, LibXfont2
• Privilege escalation in libxfont (Alpine package)
• Privilege escalation in libxfont2 (Alpine package)
• Fedora 26 update for libXfont
• Fedora 27 update for libXfont
• Fedora 27 update for libXfont2
• Fedora 26 update for libXfont2
• Ubuntu update for libxfont