{"schemaVersion":3,"id":"CVE-2006-3740","aliases":["DEBIAN-CVE-2006-3740"],"status":"published","duplicateOf":null,"title":null,"description":"Integer overflow in the scan_cidfont function in X.Org 6.8.2 and XFree86 X server allows local users to execute arbitrary code via crafted (1) CMap and (2) CIDFont font data with modified item counts in the (a) begincodespacerange, (b) cidrange, and (c) notdefrange sections.","dates":{"published":"2006-09-13T01:00:00.000Z","modified":"2024-08-07T18:39:54.017Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.2,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.2,"severity":"high","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00519,"percentile":0.42884,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00519},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00519,"percentile":0.42884}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00519,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00519,"percentile":0.42884}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"debian","product":"libxfont","name":"libxfont","label":"libxfont","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/libxfont","purlType":"deb","versions":[{"text":"< 1:1.2.2-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1:1.2.2-1","eol":null,"hubHref":null},{"vendor":"x.org","product":"x.org","name":"x.org","label":"x.org","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"6.8.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.8.2","eol":null,"hubHref":"/vendor/xorg/xorg"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://secunia.com/advisories/23907","label":"secunia.com/advisories/23907","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.redhat.com/support/errata/RHSA-2006-0666.html","label":"www.redhat.com/support/errata/RHSA-2006-0666.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Patch"]},{"url":"http://support.avaya.com/elmodocs2/security/ASA-2006-191.htm","label":"support.avaya.com/elmodocs2/security/ASA-2006-191.htm","hostname":"support.avaya.com","tags":["X Refsource CONFIRM"]},{"url":"http://secunia.com/advisories/21900","label":"secunia.com/advisories/21900","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.mandriva.com/security/advisories?name=MDKSA-2006:164","label":"www.mandriva.com/security/advisories?name=MDKSA-2006:164","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA"]},{"url":"http://secunia.com/advisories/21904","label":"secunia.com/advisories/21904","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.novell.com/linux/security/advisories/2006_23_sr.html","label":"www.novell.com/linux/security/advisories/2006_23_sr.html","hostname":"www.novell.com","tags":["Vendor Advisory","X Refsource SUSE"]},{"url":"http://secunia.com/advisories/21864","label":"secunia.com/advisories/21864","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/21894","label":"secunia.com/advisories/21894","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.ubuntu.com/usn/usn-344-1","label":"www.ubuntu.com/usn/usn-344-1","hostname":"www.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU"]},{"url":"http://secunia.com/advisories/21889","label":"secunia.com/advisories/21889","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/21908","label":"secunia.com/advisories/21908","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.redhat.com/support/errata/RHSA-2006-0665.html","label":"www.redhat.com/support/errata/RHSA-2006-0665.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Patch"]},{"url":"http://secunia.com/advisories/22141","label":"secunia.com/advisories/22141","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://support.avaya.com/elmodocs2/security/ASA-2006-190.htm","label":"support.avaya.com/elmodocs2/security/ASA-2006-190.htm","hostname":"support.avaya.com","tags":["X Refsource CONFIRM"]},{"url":"http://www.vupen.com/english/advisories/2007/1171","label":"www.vupen.com/english/advisories/2007/1171","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://www.debian.org/security/2006/dsa-1193","label":"www.debian.org/security/2006/dsa-1193","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN"]},{"url":"http://secunia.com/advisories/22080","label":"secunia.com/advisories/22080","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"https://issues.rpath.com/browse/RPL-614","label":"issues.rpath.com/browse/RPL-614","hostname":"issues.rpath.com","tags":["X Refsource CONFIRM"]},{"url":"http://www.vmware.com/support/esx25/doc/esx-254-200702-patch.html","label":"www.vmware.com/support/esx25/doc/esx-254-200702-patch.html","hostname":"www.vmware.com","tags":["X Refsource CONFIRM"]},{"url":"http://secunia.com/advisories/22332","label":"secunia.com/advisories/22332","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/22560","label":"secunia.com/advisories/22560","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.securityfocus.com/archive/1/464268/100/0/threaded","label":"www.securityfocus.com/archive/1/464268/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://secunia.com/advisories/23033","label":"secunia.com/advisories/23033","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.securityfocus.com/archive/1/445812/100/0/threaded","label":"www.securityfocus.com/archive/1/445812/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://www.idefense.com/intelligence/vulnerabilities/display.php?id=411","label":"www.idefense.com/intelligence/vulnerabilities/display.php?id=411","hostname":"www.idefense.com","tags":["Third Party Advisory","X Refsource IDEFENSE","Patch","Vendor Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9454","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9454","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]},{"url":"http://security.gentoo.org/glsa/glsa-200609-07.xml","label":"security.gentoo.org/glsa/glsa-200609-07.xml","hostname":"security.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-102780-1","label":"sunsolve.sun.com/search/document.do?assetkey=1-26-102780-1","hostname":"sunsolve.sun.com","tags":["Vendor Advisory","X Refsource SUNALERT"]},{"url":"http://secunia.com/advisories/24636","label":"secunia.com/advisories/24636","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.vupen.com/english/advisories/2007/0322","label":"www.vupen.com/english/advisories/2007/0322","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://secunia.com/advisories/21890","label":"secunia.com/advisories/21890","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.securityfocus.com/bid/19974","label":"www.securityfocus.com/bid/19974","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"http://securitytracker.com/id?1016828","label":"securitytracker.com/id?1016828","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"http://www.vupen.com/english/advisories/2006/3581","label":"www.vupen.com/english/advisories/2006/3581","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://secunia.com/advisories/21924","label":"secunia.com/advisories/21924","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.vupen.com/english/advisories/2006/3582","label":"www.vupen.com/english/advisories/2006/3582","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://secunia.com/advisories/23899","label":"secunia.com/advisories/23899","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/28890","label":"exchange.xforce.ibmcloud.com/vulnerabilities/28890","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2006-3740","label":"security-tracker.debian.org/tracker/CVE-2006-3740","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["DSA-1193-1","RHSA-2006:0665","RHSA-2006:0666"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2006-09-13T01:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T18:39:54.017Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":29,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T03:50:13.220Z","stale":false,"partial":false}}