Test ID:	1.3.6.1.4.1.25623.1.0.120495
Category:	Amazon Linux Local Security Checks
Title:	Amazon Linux: Security Advisory (ALAS-2014-404)
Summary:	The remote host is missing an update for the 'libXfont' package(s) announced via the ALAS-2014-404 advisory.
Description:	Summary: The remote host is missing an update for the 'libXfont' package(s) announced via the ALAS-2014-404 advisory. Vulnerability Insight: Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow. Multiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs protocol reply to the (1) _fs_recv_conn_setup, (2) fs_read_open_font, (3) fs_read_query_info, (4) fs_read_extent_info, (5) fs_read_glyphs, (6) fs_read_list, or (7) fs_read_list_info function. Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path, which triggers a heap-based buffer overflow, related to metadata. Affected Software/OS: 'libXfont' package(s) on Amazon Linux. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-0209 BugTraq ID: 67382 http://www.securityfocus.com/bid/67382 Bugtraq: 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (Google Search) http://www.securityfocus.com/archive/1/534161/100/0/threaded Debian Security Information: DSA-2927 (Google Search) http://www.debian.org/security/2014/dsa-2927 http://seclists.org/fulldisclosure/2014/Dec/23 http://www.mandriva.com/security/advisories?name=MDVSA-2015:145 http://lists.x.org/archives/xorg-announce/2014-May/002431.html RedHat Security Advisories: RHSA-2014:1893 http://rhn.redhat.com/errata/RHSA-2014-1893.html http://secunia.com/advisories/59154 SuSE Security Announcement: openSUSE-SU-2014:0711 (Google Search) http://lists.opensuse.org/opensuse-updates/2014-05/msg00073.html http://www.ubuntu.com/usn/USN-2211-1 Common Vulnerability Exposure (CVE) ID: CVE-2014-0210 Common Vulnerability Exposure (CVE) ID: CVE-2014-0211
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.