LibXfont, LibXfont2: Arbitrary file access

Background

X.Org Xfont library.

Description

It was discovered that libXfont incorrectly followed symlinks when opening font files.

Impact

A local unprivileged user could use this flaw to cause the X server to access arbitrary files, including special device files.

Workaround

There is no known workaround at this time.

Resolution

All LibXfont users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=x11-libs/libXfont-1.5.4"

All LibXfont2 users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=x11-libs/libXfont2-2.0.3"