CVE-2004-0084 EXPLOIT
10.0
HIGH · CVSS 2.0 · EPSS 24.9% (pctl 98)
Patch early
A public exploit exists.
Description
Buffer overflow in the ReadFontAlias function in XFree86 4.1.0 to 4.3.0, when using the CopyISOLatin1Lowered function, allows local or remote authenticated users to execute arbitrary code via a malformed entry in the font alias (font.alias) file, a different vulnerability than CVE-2004-0083 and CVE-2004-0106.
Scoring
| CVSS | 10.0 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| EPSS | 24.86% — more likely to be exploited than 98% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2004-03-03 |
| Last modified | 2026-06-16 |
Affected (2)
| Vendor | Product |
|---|---|
| openbsd | openbsd |
| xfree86 project | x11r6 |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | XFree86 4.x - CopyISOLatin1Lowered Font_Name Buffer Overflow | 2004-02-12 |
References
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000821
- http://marc.info/?l=bugtraq&m=107662833512775&w=2
- http://marc.info/?l=bugtraq&m=110979666528890&w=2
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-57768-1
- http://www.debian.org/security/2004/dsa-443
- http://www.idefense.com/application/poi/display?id=73
- http://www.kb.cert.org/vuls/id/667502
- http://www.mandriva.com/security/advisories?name=MDKSA-2004:012
- http://www.novell.com/linux/security/advisories/2004_06_xf86.html
- http://www.redhat.com/support/errata/RHSA-2004-059.html
- http://www.redhat.com/support/errata/RHSA-2004-060.html
- http://www.redhat.com/support/errata/RHSA-2004-061.html
- http://www.securityfocus.com/bid/9652
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.405053
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15200
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10405
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A807
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A831
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000821
- http://marc.info/?l=bugtraq&m=107662833512775&w=2
→ the Explorer · watch your stack · NVD