CVE-2017-13720

In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with access to an X connection can cause a buffer over-read during pattern matching of fonts, leading to information disclosure or a crash (denial of service). This occurs because '\0' characters are incorrectly skipped in situations involving ? characters.

• CWE-125

• http://www.debian.org/security/2017/dsa-3995
• https://bugzilla.redhat.com/show_bug.cgi?id=1500690Issue Tracking, Third Party Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1054285Issue Tracking, Third Party Advisory
• https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d1e670a4a8704b8708e493ab6155589bcd570608Patch, Third Party Advisory
• https://security.gentoo.org/glsa/201711-08
• https://www.x.org/releases/individual/lib/libXfont2-2.0.2.tar.bz2Vendor Advisory
• http://www.debian.org/security/2017/dsa-3995
• https://bugzilla.redhat.com/show_bug.cgi?id=1500690Issue Tracking, Third Party Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1054285Issue Tracking, Third Party Advisory
• https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d1e670a4a8704b8708e493ab6155589bcd570608Patch, Third Party Advisory
• https://security.gentoo.org/glsa/201711-08
• https://www.x.org/releases/individual/lib/libXfont2-2.0.2.tar.bz2Vendor Advisory

Published

Oct 11, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-13715The __skb_flow_dissect function in net/core/flow_dissector.c…9.8
• CVE-2017-13716The C++ symbol demangler routine in cplus-dem.c in libiberty…
• CVE-2017-13717Starry Station (aka Starry Router) sets the Access-Control-A…
• CVE-2017-13718The HTTP API supported by Starry Station (aka Starry Router)…
• CVE-2017-13719The Amcrest IPM-721S Amcrest_IPC-AWXX_Eng_N_V2.420.AC00.17.R…
• CVE-2017-1372IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 is vulner…
• CVE-2017-13721In X.Org Server (aka xserver and xorg-server) before 1.19.4,…
• CVE-2017-13722In the pcfGetProperties function in bitmap/pcfread.c in libX…
• CVE-2017-13723In X.Org Server (aka xserver and xorg-server) before 1.19.4,…
• CVE-2017-13724On the Axesstel MU553S MU55XS-V1.14, there is a Stored Cross…
• CVE-2017-13725The IPv6 routing header parser in tcpdump before 4.9.2 has a…9.8
• CVE-2017-13726There is a reachable assertion abort in the function TIFFWri…