Synopsis

Important: libXfont security update

Type/Severity

Security Advisory: Important

Topic

Updated libXfont packages that fix one security issue are now available for
Red Hat Enterprise Linux 5.6 Extended Update Support.

The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

Description

The libXfont packages provide the X.Org libXfont runtime library. X.Org is
an open source implementation of the X Window System.

A buffer overflow flaw was found in the way the libXfont library, used by
the X.Org server, handled malformed font files compressed using UNIX
compress. A malicious, local user could exploit this issue to potentially
execute arbitrary code with the privileges of the X.Org server.
(CVE-2011-2895)

Users of libXfont should upgrade to these updated packages, which contain a
backported patch to resolve this issue. All running X.Org server instances
must be restarted for the update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server - Extended Update Support 5.6 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.6 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.6 i386
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6 i386
• Red Hat Enterprise Linux Server - AUS 5.6 x86_64
• Red Hat Enterprise Linux Server - AUS 5.6 ia64
• Red Hat Enterprise Linux Server - AUS 5.6 i386
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.6 s390x
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.6 ppc

Fixes

• BZ - 725760 - CVE-2011-2895 libXfont: LZW decompression heap corruption / infinite loop
• BZ - 727624 - CVE-2011-2895 BSD compress LZW decoder buffer overflow

CVEs

• CVE-2011-2895

References

• https://access.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux Server - Extended Update Support 5.6

SRPM
libXfont-1.2.2-1.0.3.el5_6.src.rpm	SHA-256: 8fb919365bbf230a0641c654ea5f4ccace7d9a4bb0ab5a0c20a18e012b92b091
x86_64
libXfont-1.2.2-1.0.3.el5_6.i386.rpm	SHA-256: 51fefc39c9b705063b3ea40432b4fb5e5efbb3f7fbc0af77e33e9b35dc662926
libXfont-1.2.2-1.0.3.el5_6.x86_64.rpm	SHA-256: 665bb52b0c6ec4d7f841ac1689873195021f35920403952b640c4207a7970ea0
libXfont-devel-1.2.2-1.0.3.el5_6.i386.rpm	SHA-256: c5c903d49f79f7ba8b9769c2c98b4a06d5ce946f1ad8677343e4edc630be7b0c
libXfont-devel-1.2.2-1.0.3.el5_6.x86_64.rpm	SHA-256: 665315ece0c934e3216aeea0c130692bd5681ca6009ed06e24c843b5cd809b0a
ia64
libXfont-1.2.2-1.0.3.el5_6.ia64.rpm	SHA-256: 5df189533c8922d251f7c62a104d1e903409194110b20c2f79f9ba464e0e8d13
libXfont-devel-1.2.2-1.0.3.el5_6.ia64.rpm	SHA-256: 24e2ccddd46b9228ee873308a7e18d99f106fc91c783c0d4bc6abfc9f564cb30
i386
libXfont-1.2.2-1.0.3.el5_6.i386.rpm	SHA-256: 51fefc39c9b705063b3ea40432b4fb5e5efbb3f7fbc0af77e33e9b35dc662926
libXfont-devel-1.2.2-1.0.3.el5_6.i386.rpm	SHA-256: c5c903d49f79f7ba8b9769c2c98b4a06d5ce946f1ad8677343e4edc630be7b0c

Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6

SRPM
libXfont-1.2.2-1.0.3.el5_6.src.rpm	SHA-256: 8fb919365bbf230a0641c654ea5f4ccace7d9a4bb0ab5a0c20a18e012b92b091
x86_64
libXfont-1.2.2-1.0.3.el5_6.i386.rpm	SHA-256: 51fefc39c9b705063b3ea40432b4fb5e5efbb3f7fbc0af77e33e9b35dc662926
libXfont-1.2.2-1.0.3.el5_6.x86_64.rpm	SHA-256: 665bb52b0c6ec4d7f841ac1689873195021f35920403952b640c4207a7970ea0
libXfont-devel-1.2.2-1.0.3.el5_6.i386.rpm	SHA-256: c5c903d49f79f7ba8b9769c2c98b4a06d5ce946f1ad8677343e4edc630be7b0c
libXfont-devel-1.2.2-1.0.3.el5_6.x86_64.rpm	SHA-256: 665315ece0c934e3216aeea0c130692bd5681ca6009ed06e24c843b5cd809b0a
i386
libXfont-1.2.2-1.0.3.el5_6.i386.rpm	SHA-256: 51fefc39c9b705063b3ea40432b4fb5e5efbb3f7fbc0af77e33e9b35dc662926
libXfont-devel-1.2.2-1.0.3.el5_6.i386.rpm	SHA-256: c5c903d49f79f7ba8b9769c2c98b4a06d5ce946f1ad8677343e4edc630be7b0c

Red Hat Enterprise Linux Server - AUS 5.6

SRPM
libXfont-1.2.2-1.0.3.el5_6.src.rpm	SHA-256: 8fb919365bbf230a0641c654ea5f4ccace7d9a4bb0ab5a0c20a18e012b92b091
x86_64
libXfont-1.2.2-1.0.3.el5_6.i386.rpm	SHA-256: 51fefc39c9b705063b3ea40432b4fb5e5efbb3f7fbc0af77e33e9b35dc662926
libXfont-1.2.2-1.0.3.el5_6.x86_64.rpm	SHA-256: 665bb52b0c6ec4d7f841ac1689873195021f35920403952b640c4207a7970ea0
libXfont-devel-1.2.2-1.0.3.el5_6.i386.rpm	SHA-256: c5c903d49f79f7ba8b9769c2c98b4a06d5ce946f1ad8677343e4edc630be7b0c
libXfont-devel-1.2.2-1.0.3.el5_6.x86_64.rpm	SHA-256: 665315ece0c934e3216aeea0c130692bd5681ca6009ed06e24c843b5cd809b0a
ia64
libXfont-1.2.2-1.0.3.el5_6.ia64.rpm	SHA-256: 5df189533c8922d251f7c62a104d1e903409194110b20c2f79f9ba464e0e8d13
libXfont-devel-1.2.2-1.0.3.el5_6.ia64.rpm	SHA-256: 24e2ccddd46b9228ee873308a7e18d99f106fc91c783c0d4bc6abfc9f564cb30
i386
libXfont-1.2.2-1.0.3.el5_6.i386.rpm	SHA-256: 51fefc39c9b705063b3ea40432b4fb5e5efbb3f7fbc0af77e33e9b35dc662926
libXfont-devel-1.2.2-1.0.3.el5_6.i386.rpm	SHA-256: c5c903d49f79f7ba8b9769c2c98b4a06d5ce946f1ad8677343e4edc630be7b0c

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.6

SRPM
libXfont-1.2.2-1.0.3.el5_6.src.rpm	SHA-256: 8fb919365bbf230a0641c654ea5f4ccace7d9a4bb0ab5a0c20a18e012b92b091
s390x
libXfont-1.2.2-1.0.3.el5_6.s390.rpm	SHA-256: 445eb02e62c2ff6359b4f8b4ec20058d6006c197ca085519df1407cacc26e070
libXfont-1.2.2-1.0.3.el5_6.s390x.rpm	SHA-256: ed9d74334deaee3d96bf0b7ddad05608588dd847cf758082083a1fae56b21782
libXfont-devel-1.2.2-1.0.3.el5_6.s390.rpm	SHA-256: 2618429841a2c05abf621130f966de73533a6a17c0bff4bf967bfe5550f7b5e0
libXfont-devel-1.2.2-1.0.3.el5_6.s390x.rpm	SHA-256: 21dca1f96ca5de20adc8d6bc07301843279dafd55f5a645b87a7552f23ba998b

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.6

SRPM
libXfont-1.2.2-1.0.3.el5_6.src.rpm	SHA-256: 8fb919365bbf230a0641c654ea5f4ccace7d9a4bb0ab5a0c20a18e012b92b091
ppc
libXfont-1.2.2-1.0.3.el5_6.ppc.rpm	SHA-256: 914a6af3193d36d323bb82420b23d0d59829baf32735eeb3a0c6b015974333d6
libXfont-1.2.2-1.0.3.el5_6.ppc64.rpm	SHA-256: ccf7102b01375dde721a5cb8550682ed608c5fb3c2e82edfb57d5e3abb7b532a
libXfont-devel-1.2.2-1.0.3.el5_6.ppc.rpm	SHA-256: a98ccf7226d919079994e895a40146afc2c266334e41e861104c73395064128e
libXfont-devel-1.2.2-1.0.3.el5_6.ppc64.rpm	SHA-256: 8d97250695a8f24f53bb26cfa6071a2dade886bc26bec3ae1a155024be59ce83