Updated libxfont packages has been released for Debian GNU/Linux 7 LTS
Package : libxfont
Version : 1:1.4.5-5+deb7u1
CVE IDs : CVE-2017-13720 CVE-2017-13722
It was discovered that there two vulnerabilities the library providing
font selection and rasterisation, libxfont:
* CVE-2017-13720: If a pattern contained a '?' character any character
in the string is skipped even if it was a '\0'. The rest of the
matching then read invalid memory.
* CVE-2017-13722: A malformed PCF file could cause the library to make
reads from random heap memory that was behind the `strings` buffer,
leading to an application crash or a information leak.
For Debian 7 "Wheezy", this issue has been fixed in libxfont version
1:1.4.5-5+deb7u1.
We recommend that you upgrade your libxfont packages.