vulnwire
7.5high

CVE-2007-4990in critical feed

The swap_char2b function in X.Org X Font Server (xfs) before 1.0.5 allows context-dependent attackers to execute arbitrary code via (1) Que…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
10.7%
percentile 96%
Public exploits
0
none known

The swap_char2b function in X.Org X Font Server (xfs) before 1.0.5 allows context-dependent attackers to execute arbitrary code via (1) QueryXBitmaps and (2) QueryXExtents protocol requests with crafted size values that specify an arbitrary number of bytes to be swapped on the heap, which triggers heap corruption.

Exploit prediction (EPSS)

10.74% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

References

  • novell.com /linux/security/advisories/2007_54_xorg.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • securitytracker.com /id?1018763 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • secunia.com /advisories/28542 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • sunsolve.sun.com /search/document.do?assetkey=1-66-200642-1 · vendor-advisory, x_refsource_SUNALERT, x_transferred
  • redhat.com /archives/fedora-package-announce/2007-December/msg00352.html · vendor-advisory, x_refsource_FEDORA, x_transferred
  • securityfocus.com /archive/1/481432/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • bugs.freedesktop.org /show_bug.cgi?id=12299 · x_refsource_CONFIRM, x_transferred
  • secunia.com /advisories/28514 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/27052 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • labs.idefense.com /intelligence/vulnerabilities/display.php?id=602 · third-party-advisory, x_refsource_IDEFENSE, x_transferred
  • secunia.com /advisories/27060 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vupen.com /english/advisories/2008/0924/references · vdb-entry, x_refsource_VUPEN, x_transferred
  • h20000.www2.hp.com /bizsupport/TechSupport/Document.jsp?objectID=c01323725 · vendor-advisory, x_refsource_HP, x_transferred
  • lists.freedesktop.org /archives/xorg-announce/2007-October/000416.html · mailing-list, x_refsource_MLIST, x_transferred
  • redhat.com /support/errata/RHSA-2008-0029.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • secunia.com /advisories/28004 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/27240 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • issues.rpath.com /browse/RPL-1756 · x_refsource_CONFIRM, x_transferred
  • secunia.com /advisories/29420 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/27040 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • lists.apple.com /archives/security-announce/2008/Mar/msg00001.html · vendor-advisory, x_refsource_APPLE, x_transferred
  • secunia.com /advisories/27176 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • security.gentoo.org /glsa/glsa-200710-11.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • secunia.com /advisories/27228 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vupen.com /english/advisories/2007/3467 · vdb-entry, x_refsource_VUPEN, x_transferred
  • redhat.com /support/errata/RHSA-2008-0030.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • sunsolve.sun.com /search/document.do?assetkey=1-26-103114-1 · vendor-advisory, x_refsource_SUNALERT, x_transferred
  • vupen.com /english/advisories/2008/0149 · vdb-entry, x_refsource_VUPEN, x_transferred
  • mandriva.com /security/advisories?name=MDKSA-2007:210 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
  • securityfocus.com /bid/25898 · vdb-entry, x_refsource_BID, x_transferred
  • bugs.gentoo.org /show_bug.cgi?id=194606 · x_refsource_CONFIRM, x_transferred
  • vupen.com /english/advisories/2007/3338 · vdb-entry, x_refsource_VUPEN, x_transferred
  • secunia.com /advisories/27560 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11599 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • docs.info.apple.com /article.html?artnum=307562 · x_refsource_CONFIRM, x_transferred
  • vupen.com /english/advisories/2007/3337 · vdb-entry, x_refsource_VUPEN, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/36920 · vdb-entry, x_refsource_XF, x_transferred
  • secunia.com /advisories/28536 · third-party-advisory, x_refsource_SECUNIA, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.