Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2011-2895 Details

Description

The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d11ee5886e9d9ec610051a206b135a4cdc1e09a0	CVE	Patch
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2011-007.txt.asc	CVE
http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html	CVE
http://lists.apple.com/archives/security-announce/2012/May/msg00001.html	CVE
http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html	CVE
http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html	CVE
http://lists.apple.com/archives/security-announce/2015/Dec/msg00002.html	CVE
http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html	CVE
http://lists.freedesktop.org/archives/xorg-announce/2011-August/001721.html	CVE	Patch
http://lists.freedesktop.org/archives/xorg-announce/2011-August/001722.html	CVE	Patch
http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00019.html	CVE
http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00004.html	CVE
https://bugzilla.redhat.com/show_bug.cgi?id=725760	CVE	Patch
https://bugzilla.redhat.com/show_bug.cgi?id=727624	CVE
http://secunia.com/advisories/45544	CVE	Vendor Advisory
http://secunia.com/advisories/45568	CVE	Vendor Advisory
http://secunia.com/advisories/45599	CVE	Vendor Advisory
http://secunia.com/advisories/45986	CVE
http://secunia.com/advisories/46127	CVE
http://secunia.com/advisories/48951	CVE
http://securitytracker.com/id?1025920	CVE
https://exchange.xforce.ibmcloud.com/vulnerabilities/69141	CVE
https://support.apple.com/HT205635	CVE
https://support.apple.com/HT205637	CVE
https://support.apple.com/HT205640	CVE
https://support.apple.com/HT205641	CVE
http://support.apple.com/kb/HT5130	CVE
http://support.apple.com/kb/HT5281	CVE
http://www.debian.org/security/2011/dsa-2293	CVE
http://www.mandriva.com/security/advisories?name=MDVSA-2011:153	CVE
http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/compress/zopen.c#rev1.17	CVE
http://www.openwall.com/lists/oss-security/2011/08/10/10	CVE
http://www.redhat.com/support/errata/RHSA-2011-1154.html	CVE	Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2011-1155.html	CVE	Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2011-1161.html	CVE	Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2011-1834.html	CVE
http://www.securityfocus.com/bid/49124	CVE
http://www.ubuntu.com/usn/USN-1191-1	CVE
http://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d11ee5886e9d9ec610051a206b135a4cdc1e09a0	[email protected]	Patch
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2011-007.txt.asc	[email protected]
http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html	[email protected]
http://lists.apple.com/archives/security-announce/2012/May/msg00001.html	[email protected]
http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html	[email protected]
http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html	[email protected]
http://lists.apple.com/archives/security-announce/2015/Dec/msg00002.html	[email protected]
http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html	[email protected]
http://lists.freedesktop.org/archives/xorg-announce/2011-August/001721.html	[email protected]	Patch
http://lists.freedesktop.org/archives/xorg-announce/2011-August/001722.html	[email protected]	Patch
http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00019.html	[email protected]
http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00004.html	[email protected]
https://bugzilla.redhat.com/show_bug.cgi?id=725760	[email protected]	Patch
https://bugzilla.redhat.com/show_bug.cgi?id=727624	[email protected]
http://secunia.com/advisories/45544	[email protected]	Vendor Advisory
http://secunia.com/advisories/45568	[email protected]	Vendor Advisory
http://secunia.com/advisories/45599	[email protected]	Vendor Advisory
http://secunia.com/advisories/45986	[email protected]
http://secunia.com/advisories/46127	[email protected]
http://secunia.com/advisories/48951	[email protected]
http://securitytracker.com/id?1025920	[email protected]
https://exchange.xforce.ibmcloud.com/vulnerabilities/69141	[email protected]
https://support.apple.com/HT205635	[email protected]
https://support.apple.com/HT205637	[email protected]
https://support.apple.com/HT205640	[email protected]
https://support.apple.com/HT205641	[email protected]
http://support.apple.com/kb/HT5130	[email protected]
http://support.apple.com/kb/HT5281	[email protected]
http://www.debian.org/security/2011/dsa-2293	[email protected]
http://www.mandriva.com/security/advisories?name=MDVSA-2011:153	[email protected]
http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/compress/zopen.c#rev1.17	[email protected]
http://www.openwall.com/lists/oss-security/2011/08/10/10	[email protected]
http://www.redhat.com/support/errata/RHSA-2011-1154.html	[email protected]	Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2011-1155.html	[email protected]	Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2011-1161.html	[email protected]	Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2011-1834.html	[email protected]
http://www.securityfocus.com/bid/49124	[email protected]
http://www.ubuntu.com/usn/USN-1191-1	[email protected]

see all 76 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-119	Improper Restriction of Operations within the Bounds of a Memory Buffer	[email protected]

Affected Products

Product	Versions
freetype freetype	2.1.9
CPE cpe:2.3:a:freetype:freetype:2.1.9:::::::* Remediation No remediation found in references.
x libxfont	<= 1.4.3 1.2.0 1.2.1 1.2.2 1.2.3
CPE cpe:2.3:a:x:libxfont:::::::: cpe:2.3:a:x:libxfont:1.2.0:::::::* cpe:2.3:a:x:libxfont:1.2.1:::::::* cpe:2.3:a:x:libxfont:1.2.2:::::::* cpe:2.3:a:x:libxfont:1.2.3:::::::* cpe:2.3:a:x:libxfont:1.2.4:::::::* cpe:2.3:a:x:libxfont:1.2.5:::::::* cpe:2.3:a:x:libxfont:1.2.6:::::::* cpe:2.3:a:x:libxfont:1.2.7:::::::* cpe:2.3:a:x:libxfont:1.2.8:::::::* cpe:2.3:a:x:libxfont:1.2.9:::::::* cpe:2.3:a:x:libxfont:1.3.0:::::::* cpe:2.3:a:x:libxfont:1.3.1:::::::* cpe:2.3:a:x:libxfont:1.3.2:::::::* cpe:2.3:a:x:libxfont:1.3.3:::::::* cpe:2.3:a:x:libxfont:1.3.4:::::::* cpe:2.3:a:x:libxfont:1.4.0:::::::* cpe:2.3:a:x:libxfont:1.4.1:::::::* cpe:2.3:a:x:libxfont:1.4.2:::::::* Remediation No remediation found in references.
freebsd freebsd	All versions
CPE cpe:2.3:o:freebsd:freebsd:::::::: Remediation No remediation found in references.
netbsd netbsd	All versions
CPE cpe:2.3:o:netbsd:netbsd:::::::: Remediation No remediation found in references.
openbsd openbsd	<= 3.7 2.0 2.1 2.2 2.3
CPE cpe:2.3:o:openbsd:openbsd:::::::: cpe:2.3:o:openbsd:openbsd:2.0:::::::* cpe:2.3:o:openbsd:openbsd:2.1:::::::* cpe:2.3:o:openbsd:openbsd:2.2:::::::* cpe:2.3:o:openbsd:openbsd:2.3:::::::* cpe:2.3:o:openbsd:openbsd:2.4:::::::* cpe:2.3:o:openbsd:openbsd:2.5:::::::* cpe:2.3:o:openbsd:openbsd:2.6:::::::* cpe:2.3:o:openbsd:openbsd:2.7:::::::* cpe:2.3:o:openbsd:openbsd:2.8:::::::* cpe:2.3:o:openbsd:openbsd:2.9:::::::* cpe:2.3:o:openbsd:openbsd:3.0:::::::* cpe:2.3:o:openbsd:openbsd:3.1:::::::* cpe:2.3:o:openbsd:openbsd:3.2:::::::* cpe:2.3:o:openbsd:openbsd:3.3:::::::* cpe:2.3:o:openbsd:openbsd:3.4:::::::* cpe:2.3:o:openbsd:openbsd:3.5:::::::* cpe:2.3:o:openbsd:openbsd:3.6:::::::* Remediation No remediation found in references.

Change History

7 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Apr 29, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Aug 29, 2017	CVE Modified	[email protected]
Dec 12, 2015	CVE Modified	[email protected]
Aug 22, 2011	Initial Analysis	[email protected]

CVE-2011-2895 Details

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

Change History

QUICK INFO