Integer overflow in the CIDAFM function in X.Org 6.8.2 and XFree86 X server allows local users to execute arbitrary code via crafted Adobe…

Description

Integer overflow in the CIDAFM function in X.Org 6.8.2 and XFree86 X server allows local users to execute arbitrary code via crafted Adobe Font Metrics (AFM) files with a modified number of character metrics (StartCharMetrics), which leads to a heap-based buffer overflow.

Scores

EPSS (exploitation in 30 days)

0.59% · top 51% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.

Weakness

• n/a

Affected products

• n/a

  • affected n/a

References (39)

• RHSA-2006:0666 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• http://support.avaya.com/elmodocs2/security/ASA-2006-191.htm (opens in a new tab)x_refsource_CONFIRMx_transferred
• 21900 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• MDKSA-2006:164 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• 21904 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• SUSE-SR:2006:023 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• 21864 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 21894 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• USN-344-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• 21889 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 21908 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 102714 (opens in a new tab)vendor-advisoryx_refsource_SUNALERTx_transferred
• RHSA-2006:0665 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• 22141 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://support.avaya.com/elmodocs2/security/ASA-2006-190.htm (opens in a new tab)x_refsource_CONFIRMx_transferred
• ADV-2007-1171 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• DSA-1193 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• xorg-server-cidafm-overflow(28899) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• 22080 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• https://issues.rpath.com/browse/RPL-614 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.vmware.com/support/esx25/doc/esx-254-200702-patch.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• 22332 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 22560 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 20070330 VMSA-2007-0002 VMware ESX security updates (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 23033 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 20060912 rPSA-2006-0167-1 xorg-x11 xorg-x11-fonts xorg-x11-tools xorg-x11-xfs (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• oval:org.mitre.oval:def:10305 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• GLSA-200609-07 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• 102780 (opens in a new tab)vendor-advisoryx_refsource_SUNALERTx_transferred
• 20060912 Multiple Vendor X Server CID-keyed Fonts 'CIDAFM()' Integer Overflow Vulnerability (opens in a new tab)third-party-advisoryx_refsource_IDEFENSEx_transferred
• 24636 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2007-0322 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 21890 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 19974 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• 1016828 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• ADV-2006-3581 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 21924 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2006-3582 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 23899 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2006-3739](https://trackcve.app/badge/CVE-2006-3739.svg)](https://trackcve.app/cve/CVE-2006-3739)

Record last updated 7 Aug 2024, 18:39 UTC.