CVE-2013-6462

Stack-based buffer overflow in the bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont 1.1 through 1.4.6 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in a character name in a BDF font file.

• CWE-119

• http://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=4d024ac10f964f6bd372ae0dd14f02772a6e5f63Exploit, Patch
• http://lists.opensuse.org/opensuse-updates/2014-01/msg00050.html
• http://lists.opensuse.org/opensuse-updates/2014-01/msg00052.html
• http://lists.x.org/archives/xorg-announce/2014-January/002389.htmlVendor Advisory
• http://osvdb.org/101842
• http://rhn.redhat.com/errata/RHSA-2014-0018.html
• http://seclists.org/oss-sec/2014/q1/33
• http://secunia.com/advisories/56240Vendor Advisory
• http://secunia.com/advisories/56336
• http://secunia.com/advisories/56357
• http://secunia.com/advisories/56371
• http://www.debian.org/security/2014/dsa-2838
• http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
• http://www.securityfocus.com/bid/64694
• http://www.ubuntu.com/usn/USN-2078-1
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90123
• http://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=4d024ac10f964f6bd372ae0dd14f02772a6e5f63Exploit, Patch
• http://lists.opensuse.org/opensuse-updates/2014-01/msg00050.html
• http://lists.opensuse.org/opensuse-updates/2014-01/msg00052.html
• http://lists.x.org/archives/xorg-announce/2014-January/002389.htmlVendor Advisory
• http://osvdb.org/101842
• http://rhn.redhat.com/errata/RHSA-2014-0018.html
• http://seclists.org/oss-sec/2014/q1/33
• http://secunia.com/advisories/56240Vendor Advisory
• http://secunia.com/advisories/56336
• http://secunia.com/advisories/56357
• http://secunia.com/advisories/56371
• http://www.debian.org/security/2014/dsa-2838
• http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
• http://www.securityfocus.com/bid/64694
• http://www.ubuntu.com/usn/USN-2078-1
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90123

Published

Jan 9, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-6456The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1…
• CVE-2013-6457The libxlDomainGetNumaParameters function in the libxl drive…
• CVE-2013-6458Multiple race conditions in the (1) virDomainBlockStats, (2)…
• CVE-2013-6459Cross-site scripting (XSS) vulnerability in the will_paginat…
• CVE-2013-6460Nokogiri gem 1.5.x has Denial of Service via infinite loop w…6.5
• CVE-2013-6461Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entit…6.5
• CVE-2013-6463Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2013-6464Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-6465Multiple cross-site scripting (XSS) vulnerabilities in JBPM …
• CVE-2013-6466Openswan 2.6.39 and earlier allows remote attackers to cause…
• CVE-2013-6467Libreswan 3.7 and earlier allows remote attackers to cause a…
• CVE-2013-6468JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat J…