Read the docs
TI-2011-02548 Aliases CVE-2011-2895GHSA-8hvp-h85w-jwq9

The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in…

Priority MEDIUM 51CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Partial Red Hat: 10 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.

Why it matters now

EPSS 0.08355 94th percentileScored 2026-11-07
Fix Partial Red Hat: 4 advisoriesRed Hat: 10 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 40

CPEVersionsRoleVendor
cpe:2.3:a:freetype:freetype:2.1.9:*:*:*:*:*:*:*2.1.9VulnerableFreeType
cpe:2.3:a:x:libxfont:*:*:*:*:*:*:*:*up to 1.4.3VulnerableX
cpe:2.3:a:x:libxfont:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableX
cpe:2.3:a:x:libxfont:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableX
cpe:2.3:a:x:libxfont:1.2.2:*:*:*:*:*:*:*1.2.2VulnerableX
cpe:2.3:a:x:libxfont:1.2.3:*:*:*:*:*:*:*1.2.3VulnerableX
cpe:2.3:a:x:libxfont:1.2.4:*:*:*:*:*:*:*1.2.4VulnerableX
cpe:2.3:a:x:libxfont:1.2.5:*:*:*:*:*:*:*1.2.5VulnerableX
cpe:2.3:a:x:libxfont:1.2.6:*:*:*:*:*:*:*1.2.6VulnerableX
cpe:2.3:a:x:libxfont:1.2.7:*:*:*:*:*:*:*1.2.7VulnerableX
  • cpe:2.3:a:freetype:freetype:2.1.9:*:*:*:*:*:*:* Versions 2.1.9 Vulnerable ·FreeType
  • cpe:2.3:a:x:libxfont:*:*:*:*:*:*:*:* Versions up to 1.4.3 Vulnerable ·X
  • cpe:2.3:a:x:libxfont:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·X
  • cpe:2.3:a:x:libxfont:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·X
  • cpe:2.3:a:x:libxfont:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·X
  • cpe:2.3:a:x:libxfont:1.2.3:*:*:*:*:*:*:* Versions 1.2.3 Vulnerable ·X
  • cpe:2.3:a:x:libxfont:1.2.4:*:*:*:*:*:*:* Versions 1.2.4 Vulnerable ·X
  • cpe:2.3:a:x:libxfont:1.2.5:*:*:*:*:*:*:* Versions 1.2.5 Vulnerable ·X
  • cpe:2.3:a:x:libxfont:1.2.6:*:*:*:*:*:*:* Versions 1.2.6 Vulnerable ·X
  • cpe:2.3:a:x:libxfont:1.2.7:*:*:*:*:*:*:* Versions 1.2.7 Vulnerable ·X
Show 30 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:x:libxfont:1.2.8:*:*:*:*:*:*:*1.2.8VulnerableX
cpe:2.3:a:x:libxfont:1.2.9:*:*:*:*:*:*:*1.2.9VulnerableX
cpe:2.3:a:x:libxfont:1.3.0:*:*:*:*:*:*:*1.3.0VulnerableX
cpe:2.3:a:x:libxfont:1.3.1:*:*:*:*:*:*:*1.3.1VulnerableX
cpe:2.3:a:x:libxfont:1.3.2:*:*:*:*:*:*:*1.3.2VulnerableX
cpe:2.3:a:x:libxfont:1.3.3:*:*:*:*:*:*:*1.3.3VulnerableX
cpe:2.3:a:x:libxfont:1.3.4:*:*:*:*:*:*:*1.3.4VulnerableX
cpe:2.3:a:x:libxfont:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableX
cpe:2.3:a:x:libxfont:1.4.1:*:*:*:*:*:*:*1.4.1VulnerableX
cpe:2.3:a:x:libxfont:1.4.2:*:*:*:*:*:*:*1.4.2VulnerableX
cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*all versionsVulnerableFreeBSD
cpe:2.3:o:netbsd:netbsd:*:*:*:*:*:*:*:*all versionsVulnerableNetBSD
cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*up to 3.7VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:2.0:*:*:*:*:*:*:*2.0VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:2.1:*:*:*:*:*:*:*2.1VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:2.2:*:*:*:*:*:*:*2.2VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:2.3:*:*:*:*:*:*:*2.3VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:2.4:*:*:*:*:*:*:*2.4VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:2.5:*:*:*:*:*:*:*2.5VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:2.6:*:*:*:*:*:*:*2.6VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:2.7:*:*:*:*:*:*:*2.7VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:2.8:*:*:*:*:*:*:*2.8VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:2.9:*:*:*:*:*:*:*2.9VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:3.0:*:*:*:*:*:*:*3.0VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:3.1:*:*:*:*:*:*:*3.1VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:3.2:*:*:*:*:*:*:*3.2VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:3.3:*:*:*:*:*:*:*3.3VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:3.4:*:*:*:*:*:*:*3.4VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:3.5:*:*:*:*:*:*:*3.5VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:3.6:*:*:*:*:*:*:*3.6VulnerableOpenBSD
  • cpe:2.3:a:x:libxfont:1.2.8:*:*:*:*:*:*:* Versions 1.2.8 Vulnerable ·X
  • cpe:2.3:a:x:libxfont:1.2.9:*:*:*:*:*:*:* Versions 1.2.9 Vulnerable ·X
  • cpe:2.3:a:x:libxfont:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·X
  • cpe:2.3:a:x:libxfont:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·X
  • cpe:2.3:a:x:libxfont:1.3.2:*:*:*:*:*:*:* Versions 1.3.2 Vulnerable ·X
  • cpe:2.3:a:x:libxfont:1.3.3:*:*:*:*:*:*:* Versions 1.3.3 Vulnerable ·X
  • cpe:2.3:a:x:libxfont:1.3.4:*:*:*:*:*:*:* Versions 1.3.4 Vulnerable ·X
  • cpe:2.3:a:x:libxfont:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·X
  • cpe:2.3:a:x:libxfont:1.4.1:*:*:*:*:*:*:* Versions 1.4.1 Vulnerable ·X
  • cpe:2.3:a:x:libxfont:1.4.2:*:*:*:*:*:*:* Versions 1.4.2 Vulnerable ·X
  • cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·FreeBSD
  • cpe:2.3:o:netbsd:netbsd:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·NetBSD
  • cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:* Versions up to 3.7 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:2.3:*:*:*:*:*:*:* Versions 2.3 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:2.4:*:*:*:*:*:*:* Versions 2.4 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:2.6:*:*:*:*:*:*:* Versions 2.6 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:2.7:*:*:*:*:*:*:* Versions 2.7 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:2.8:*:*:*:*:*:*:* Versions 2.8 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:2.9:*:*:*:*:*:*:* Versions 2.9 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:3.3:*:*:*:*:*:*:* Versions 3.3 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:3.4:*:*:*:*:*:*:* Versions 3.4 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:3.6:*:*:*:*:*:*:* Versions 3.6 Vulnerable ·OpenBSD

Remediation

Red Hat 4 advisories

  • RHSA-2011:1834 Released 2011-12-19 · Red Hat rating Important
    libXfont security update
    • Red Hat Enterprise Linux EUS (v. 5.6 server) libXfont-1.2.2-1.0.3.el5_6, libXfont-1.2.2-1.0.3.el5_6.i386, libXfont-1.2.2-1.0.3.el5_6.ia64 +5
  • RHSA-2011:1161 Released 2011-08-15 · Red Hat rating Moderate
    freetype security update
    • Red Hat Enterprise Linux AS version 4 freetype-2.1.9-19.el4, freetype-2.1.9-19.el4.i386, freetype-2.1.9-19.el4.ia64 +13
    • Red Hat Enterprise Linux Desktop version 4 freetype-2.1.9-19.el4, freetype-2.1.9-19.el4.i386, freetype-demos-2.1.9-19.el4 +5
    • Red Hat Enterprise Linux ES version 4 freetype-2.1.9-19.el4, freetype-2.1.9-19.el4.i386, freetype-2.1.9-19.el4.ia64 +9
    • Red Hat Enterprise Linux WS version 4 freetype-2.1.9-19.el4, freetype-2.1.9-19.el4.i386, freetype-2.1.9-19.el4.ia64 +9
  • RHSA-2011:1155 Released 2011-08-11 · Red Hat rating Important
    xorg-x11 security update
    • Red Hat Enterprise Linux AS version 4 xorg-x11-6.8.2-1.EL.69, xorg-x11-6.8.2-1.EL.69.i386, xorg-x11-6.8.2-1.EL.69.ia64 +47
    • Red Hat Enterprise Linux Desktop version 4 xorg-x11-6.8.2-1.EL.69, xorg-x11-6.8.2-1.EL.69.i386, xorg-x11-Mesa-libGL-6.8.2-1.EL.69 +33
    • Red Hat Enterprise Linux ES version 4 xorg-x11-6.8.2-1.EL.69, xorg-x11-6.8.2-1.EL.69.i386, xorg-x11-6.8.2-1.EL.69.ia64 +47
    • Red Hat Enterprise Linux WS version 4 xorg-x11-6.8.2-1.EL.69, xorg-x11-6.8.2-1.EL.69.i386, xorg-x11-6.8.2-1.EL.69.ia64 +47
Show 1 more Red Hat advisories
  • RHSA-2011:1154 Released 2011-08-11 · Red Hat rating Important
    libXfont security update
    • RHEL Desktop Workstation (v. 5 client) libXfont-1.2.2-1.0.4.el5_7, libXfont-devel-1.2.2-1.0.4.el5_7, libXfont-devel-1.2.2-1.0.4.el5_7.i386
    • Red Hat Enterprise Linux (v. 5 server) libXfont-1.2.2-1.0.4.el5_7, libXfont-1.2.2-1.0.4.el5_7.i386, libXfont-1.2.2-1.0.4.el5_7.ia64 +5
    • Red Hat Enterprise Linux Desktop (v. 5 client) libXfont-1.2.2-1.0.4.el5_7, libXfont-1.2.2-1.0.4.el5_7.i386
    • Red Hat Enterprise Linux Server (v. 6) libXfont-1.4.1-2.el6_1
    • Red Hat Enterprise Linux Server Optional (v. 6) libXfont-1.4.1-2.el6_1, libXfont-1.4.1-2.el6_1.ppc, libXfont-devel-1.4.1-2.el6_1 +1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
RHEL Desktop Workstation (v. 5 client)Fixed RHSA-2011:1154
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2011:1154
Red Hat Enterprise Linux AS version 4Fixed RHSA-2011:1155, RHSA-2011:1161
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2011:1154
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2011:1155, RHSA-2011:1161
Red Hat Enterprise Linux ES version 4Fixed RHSA-2011:1155, RHSA-2011:1161
Red Hat Enterprise Linux EUS (v. 5.6 server)Fixed RHSA-2011:1834
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2011:1154
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2011:1154
Red Hat Enterprise Linux WS version 4Fixed RHSA-2011:1155, RHSA-2011:1161
Not affected: 3 products
  • Red Hat Enterprise Linux 4
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-2895
  2. 2026-10-03 Alias added: GHSA-8hvp-h85w-jwq9

References

Patch 4

Advisory 16

Other 9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences