CVE catalog

CVE-2017-16611

libXfont vulnerabilities

Severity: Low · CVSS 3.3CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Published: Nov 28, 2017, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.42% · Oct 22, 2026

In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libxfont	sid	`1:2.0.9-1`	fixed
Debian	libxfont	forky	`1:2.0.9-1`	fixed
Debian	libxfont	trixie	`1:2.0.6-1+deb13u1`	fixed
Debian	libxfont	trixie-security	`1:2.0.6-1+deb13u1`	fixed
Debian	libxfont	bookworm	`1:2.0.6-1`	fixed
Debian	libxfont	bookworm-security	`1:2.0.6-1+deb12u1`	fixed
Ubuntu	libxfont	noble	`1:2.0.6-1+deb13u1build0.24.04.2`	fixed
Ubuntu	libxfont-dev	noble	`1:2.0.6-1+deb13u1build0.24.04.2`	fixed
Ubuntu	libxfont2	noble	`1:2.0.6-1+deb13u1build0.24.04.2`	fixed
Ubuntu	libxfont	pro	`1:2.0.3-1`	vulnerable
Ubuntu	libxfont	pro	`1:2.0.3-1ubuntu0.20.04.1~esm2`	fixed
Ubuntu	libxfont	22.04	`1:2.0.4-1build3`	vulnerable
Ubuntu	libxfont	22.04	`1:2.0.5-1`	vulnerable
Ubuntu	libxfont	22.04	`1:2.0.5-1build1`	vulnerable
Ubuntu	libxfont	22.04	`1:2.0.5-1ubuntu0.2`	fixed
Ubuntu	libxfont	24.04	`1:2.0.6-1`	vulnerable
Ubuntu	libxfont	24.04	`1:2.0.6-1build1`	vulnerable
Ubuntu	libxfont	24.04	`1:2.0.6-1+deb13u1build0.24.04.2`	fixed
Ubuntu	libxfont	26.04	`1:2.0.6-1build1`	vulnerable
Ubuntu	libxfont	26.04	`1:2.0.6-1build2`	vulnerable
Ubuntu	libxfont	26.04	`1:2.0.6-2`	vulnerable
Ubuntu	libxfont	26.04	`1:2.0.6-2ubuntu0.2`	fixed
Alpine	libxfont	3.10	`1.5.4-r0`	fixed
Alpine	libxfont	3.11	`1.5.4-r0`	fixed
Alpine	libxfont	3.12	`1.5.4-r0`	fixed
Alpine	libxfont	3.13	`1.5.4-r0`	fixed
Alpine	libxfont	3.14	`1.5.4-r0`	fixed
Alpine	libxfont	3.15	`1.5.4-r0`	fixed
Alpine	libxfont	3.16	`1.5.4-r0`	fixed
Alpine	libxfont	3.17	`1.5.4-r0`	fixed
Alpine	libxfont	3.7	`1.5.4-r0`	fixed
Alpine	libxfont	3.8	`1.5.4-r0`	fixed
Alpine	libxfont	3.9	`1.5.4-r0`	fixed
Alpine	libxfont2	3.10	`2.0.3-r0`	fixed
Alpine	libxfont2	3.11	`2.0.3-r0`	fixed
Alpine	libxfont2	3.12	`2.0.3-r0`	fixed
Alpine	libxfont2	3.7	`2.0.3-r0`	fixed
Alpine	libxfont2	3.8	`2.0.3-r0`	fixed
Alpine	libxfont2	3.9	`2.0.3-r0`	fixed
Ubuntu	libxfont	14.04	`1:1.4.6-1`	vulnerable
Ubuntu	libxfont	14.04	`1:1.4.6-1ubuntu1`	vulnerable
Ubuntu	libxfont	14.04	`1:1.4.7-1`	vulnerable
Ubuntu	libxfont	14.04	`1:1.4.7-1ubuntu0.1`	vulnerable
Ubuntu	libxfont	14.04	`1:1.4.7-1ubuntu0.2`	vulnerable
Ubuntu	libxfont	14.04	`1:1.4.7-1ubuntu0.3`	vulnerable
Ubuntu	libxfont	14.04	`1:1.4.7-1ubuntu0.4`	fixed
Ubuntu	libxfont	16.04	`1:1.5.1-1`	vulnerable
Ubuntu	libxfont	16.04	`1:1.5.1-1ubuntu0.16.04.1`	vulnerable
Ubuntu	libxfont	16.04	`1:1.5.1-1ubuntu0.16.04.2`	vulnerable
Ubuntu	libxfont	16.04	`1:1.5.1-1ubuntu0.16.04.3`	vulnerable
Ubuntu	libxfont	16.04	`1:1.5.1-1ubuntu0.16.04.4`	fixed
Ubuntu	libxfont2	16.04	`1:2.0.1-3~ubuntu16.04.1`	vulnerable
Ubuntu	libxfont2	16.04	`1:2.0.1-3~ubuntu16.04.2`	vulnerable
Ubuntu	libxfont2	16.04	`1:2.0.1-3~ubuntu16.04.3`	fixed
Ubuntu	libxfont	14.04	`1:1.4.6-1`	vulnerable
Ubuntu	libxfont	14.04	`1:1.4.6-1ubuntu1`	vulnerable
Ubuntu	libxfont	14.04	`1:1.4.7-1`	vulnerable
Ubuntu	libxfont	14.04	`1:1.4.7-1ubuntu0.1`	vulnerable
Ubuntu	libxfont	14.04	`1:1.4.7-1ubuntu0.2`	vulnerable
Ubuntu	libxfont	14.04	`1:1.4.7-1ubuntu0.3`	vulnerable
Ubuntu	libxfont	14.04	`1:1.4.7-1ubuntu0.4`	fixed
Ubuntu	libxfont	16.04	`1:1.5.1-1`	vulnerable
Ubuntu	libxfont	16.04	`1:1.5.1-1ubuntu0.16.04.1`	vulnerable
Ubuntu	libxfont	16.04	`1:1.5.1-1ubuntu0.16.04.2`	vulnerable
Ubuntu	libxfont	16.04	`1:1.5.1-1ubuntu0.16.04.3`	vulnerable
Ubuntu	libxfont	16.04	`1:1.5.1-1ubuntu0.16.04.4`	fixed
Ubuntu	libxfont2	16.04	`1:2.0.1-3~ubuntu16.04.1`	vulnerable
Ubuntu	libxfont2	16.04	`1:2.0.1-3~ubuntu16.04.2`	vulnerable
Ubuntu	libxfont2	16.04	`1:2.0.1-3~ubuntu16.04.3`	fixed
Opensuse	libXfont2	tumbleweed	`2.0.5-1.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libxfont	source	sid	`1:2.0.3-1`	low	Not reported	[883929]
Debian	libxfont	source	forky	`1:2.0.3-1`	low	Not reported	[883929]
Debian	libxfont	source	trixie	`1:2.0.3-1`	low	Not reported	[883929]
Debian	libxfont	source	bookworm	`1:2.0.3-1`	low	Not reported	[883929]
Ubuntu	libxfont	deb	noble	`1:2.0.6-1+deb13u1build0.24.04.2`	Not reported	Not reported	Not reported
Ubuntu	libxfont-dev	deb	noble	`1:2.0.6-1+deb13u1build0.24.04.2`	Not reported	Not reported	Not reported
Ubuntu	libxfont2	deb	noble	`1:2.0.6-1+deb13u1build0.24.04.2`	Not reported	Not reported	Not reported
Ubuntu	libxfont	deb	pro	`1:2.0.3-1ubuntu0.20.04.1~esm2`	Not reported	USN-8560-1	Not reported
Ubuntu	libxfont	deb	22.04	`1:2.0.5-1ubuntu0.2`	Not reported	USN-8560-1	Not reported
Ubuntu	libxfont	deb	24.04	`1:2.0.6-1+deb13u1build0.24.04.2`	Not reported	USN-8560-1	Not reported
Ubuntu	libxfont	deb	26.04	`1:2.0.6-2ubuntu0.2`	Not reported	USN-8560-1	Not reported
Alpine	libxfont	apk	3.10	`1.5.4-r0`	Not reported	ALPINE-CVE-2017-16611	Not reported
Alpine	libxfont	apk	3.11	`1.5.4-r0`	Not reported	ALPINE-CVE-2017-16611	Not reported
Alpine	libxfont	apk	3.12	`1.5.4-r0`	Not reported	ALPINE-CVE-2017-16611	Not reported
Alpine	libxfont	apk	3.13	`1.5.4-r0`	Not reported	ALPINE-CVE-2017-16611	Not reported
Alpine	libxfont	apk	3.14	`1.5.4-r0`	Not reported	ALPINE-CVE-2017-16611	Not reported
Alpine	libxfont	apk	3.15	`1.5.4-r0`	Not reported	ALPINE-CVE-2017-16611	Not reported
Alpine	libxfont	apk	3.16	`1.5.4-r0`	Not reported	ALPINE-CVE-2017-16611	Not reported
Alpine	libxfont	apk	3.17	`1.5.4-r0`	Not reported	ALPINE-CVE-2017-16611	Not reported
Alpine	libxfont	apk	3.7	`1.5.4-r0`	Not reported	ALPINE-CVE-2017-16611	Not reported
Alpine	libxfont	apk	3.8	`1.5.4-r0`	Not reported	ALPINE-CVE-2017-16611	Not reported
Alpine	libxfont	apk	3.9	`1.5.4-r0`	Not reported	ALPINE-CVE-2017-16611	Not reported
Alpine	libxfont2	apk	3.10	`2.0.3-r0`	Not reported	ALPINE-CVE-2017-16611	Not reported
Alpine	libxfont2	apk	3.11	`2.0.3-r0`	Not reported	ALPINE-CVE-2017-16611	Not reported
Alpine	libxfont2	apk	3.12	`2.0.3-r0`	Not reported	ALPINE-CVE-2017-16611	Not reported
Alpine	libxfont2	apk	3.7	`2.0.3-r0`	Not reported	ALPINE-CVE-2017-16611	Not reported
Alpine	libxfont2	apk	3.8	`2.0.3-r0`	Not reported	ALPINE-CVE-2017-16611	Not reported
Alpine	libxfont2	apk	3.9	`2.0.3-r0`	Not reported	ALPINE-CVE-2017-16611	Not reported
Ubuntu	libxfont	deb	14.04	`1:1.4.7-1ubuntu0.4`	Not reported	UBUNTU-CVE-2017-16611	Not reported
Ubuntu	libxfont	deb	16.04	`1:1.5.1-1ubuntu0.16.04.4`	Not reported	UBUNTU-CVE-2017-16611	Not reported
Ubuntu	libxfont2	deb	16.04	`1:2.0.1-3~ubuntu16.04.3`	Not reported	UBUNTU-CVE-2017-16611	Not reported
Ubuntu	libxfont	deb	14.04	`1:1.4.7-1ubuntu0.4`	Not reported	USN-3500-1	Not reported
Ubuntu	libxfont	deb	16.04	`1:1.5.1-1ubuntu0.16.04.4`	Not reported	USN-3500-1	Not reported
Ubuntu	libxfont2	deb	16.04	`1:2.0.1-3~ubuntu16.04.3`	Not reported	USN-3500-1	Not reported
Opensuse	libXfont2	rpm	tumbleweed	`2.0.5-1.2`	Not reported	OPENSUSE-SU-2024:10922-1	Not reported

[Debian bug #883929]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libxfont2]Unknown
Source package: [libxfont]
Details (4)
- 1:2.0.6-1 · amd64 · bookworm
  Fixed · Fixed: 1:2.0.3-1
  usn · libxfont · debian · bookworm; usn · libxfont · debian · 12
- 1:2.0.6-1 · arm64 · bookworm
  Fixed · Fixed: 1:2.0.3-1
  usn · libxfont · debian · bookworm; usn · libxfont · debian · 12
- 1:2.0.6-1+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 1:2.0.3-1
  usn · libxfont · debian · bookworm; usn · libxfont · debian · 12
- 1:2.0.6-1+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 1:2.0.3-1
  usn · libxfont · debian · bookworm; usn · libxfont · debian · 12
[libxfont-dev]Unknown
Source package: [libxfont]
Details (4)
- 1:2.0.6-1 · amd64 · bookworm
  Fixed · Fixed: 1:2.0.3-1
  usn · libxfont · debian · bookworm; usn · libxfont · debian · 12
- 1:2.0.6-1 · arm64 · bookworm
  Fixed · Fixed: 1:2.0.3-1
  usn · libxfont · debian · bookworm; usn · libxfont · debian · 12
- 1:2.0.6-1+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 1:2.0.3-1
  usn · libxfont · debian · bookworm; usn · libxfont · debian · 12
- 1:2.0.6-1+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 1:2.0.3-1
  usn · libxfont · debian · bookworm; usn · libxfont · debian · 12

[Debian 13 (Trixie)]

[libxfont2]Unknown
Source package: [libxfont]
Details (4)
- 1:2.0.6-1+b3 · amd64 · trixie
  Fixed · Fixed: 1:2.0.3-1
  usn · libxfont · debian · 13
- 1:2.0.6-1+b3 · arm64 · trixie
  Fixed · Fixed: 1:2.0.3-1
  usn · libxfont · debian · 13
- 1:2.0.6-1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1:2.0.3-1
  usn · libxfont · debian · 13
- 1:2.0.6-1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 1:2.0.3-1
  usn · libxfont · debian · 13
[libxfont-dev]Unknown
Source package: [libxfont]
Details (4)
- 1:2.0.6-1+b3 · amd64 · trixie
  Fixed · Fixed: 1:2.0.3-1
  usn · libxfont · debian · 13
- 1:2.0.6-1+b3 · arm64 · trixie
  Fixed · Fixed: 1:2.0.3-1
  usn · libxfont · debian · 13
- 1:2.0.6-1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1:2.0.3-1
  usn · libxfont · debian · 13
- 1:2.0.6-1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 1:2.0.3-1
  usn · libxfont · debian · 13

[openSUSE Tumbleweed]

[libXfont2-2]Unknown
Source package: [libXfont2]
Details (1)
- 2.0.7-3.1 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.5-1.2
  Version impact unknown
  usn · libXfont2 · opensuse · tumbleweed
[libXfont2-2-32bit]Unknown
Source package: [libXfont2]
Details (1)
- 2.0.7-3.1 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.5-1.2
  Version impact unknown
  usn · libXfont2 · opensuse · tumbleweed
[libXfont2-devel]Unknown
Source package: [libXfont2]
Details (1)
- 2.0.7-3.1 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.5-1.2
  Version impact unknown
  usn · libXfont2 · opensuse · tumbleweed
[libXfont2-devel-32bit]Unknown
Source package: [libXfont2]
Details (1)
- 2.0.7-3.1 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.5-1.2
  Version impact unknown
  usn · libXfont2 · opensuse · tumbleweed

Observed: Oct 23, 2026, 5:27:37 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]