Vulnerability Description
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Freetype | Freetype | 2.1.9 |
| X | Libxfont | <= 1.4.3 |
| Freebsd | Freebsd | All versions |
| Netbsd | Netbsd | All versions |
| Openbsd | Openbsd | <= 3.7 |
Related Weaknesses (CWE)
References
- http://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d11ee5886e9d9ec610051a2Patch
- http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2011-007.txt.asc
- http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
- http://lists.apple.com/archives/security-announce/2012/May/msg00001.html
- http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html
- http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html
- http://lists.apple.com/archives/security-announce/2015/Dec/msg00002.html
- http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html
- http://lists.freedesktop.org/archives/xorg-announce/2011-August/001721.htmlPatch
- http://lists.freedesktop.org/archives/xorg-announce/2011-August/001722.htmlPatch
- http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00019.html
- http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00004.html
- http://secunia.com/advisories/45544Vendor Advisory
- http://secunia.com/advisories/45568Vendor Advisory
- http://secunia.com/advisories/45599Vendor Advisory
FAQ
What is CVE-2011-2895?
CVE-2011-2895 is a vulnerability with a CVSS score of 9.3 (HIGH). The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, Free...
How severe is CVE-2011-2895?
CVE-2011-2895 has been rated HIGH with a CVSS base score of 9.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2011-2895?
Check the references section above for vendor advisories and patch information. Affected products include: Freetype Freetype, X Libxfont, Freebsd Freebsd, Netbsd Netbsd, Openbsd Openbsd.