{"schemaVersion":3,"id":"CVE-2007-4990","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The swap_char2b function in X.Org X Font Server (xfs) before 1.0.5 allows context-dependent attackers to execute arbitrary code via (1) QueryXBitmaps and (2) QueryXExtents protocol requests with crafted size values that specify an arbitrary number of bytes to be swapped on the heap, which triggers heap corruption.","dates":{"published":"2007-10-05T21:00:00.000Z","modified":"2024-08-07T15:17:27.847Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.10737,"percentile":0.95792,"severity":"medium","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.10737},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.10737,"percentile":0.95792}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.10737,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.10737,"percentile":0.95792}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-189","name":"Numeric Errors","description":"Weaknesses in this category are related to improper calculation or conversion of numbers.","type":"category","status":"Draft","abstraction":null,"likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/189.html"}],"affected":[{"vendor":"x.org","product":"x_font_server","name":"x font server","label":"x_font_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.0.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.0.4","eol":null,"hubHref":"/vendor/xorg/x_font_server"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.novell.com/linux/security/advisories/2007_54_xorg.html","label":"www.novell.com/linux/security/advisories/2007_54_xorg.html","hostname":"www.novell.com","tags":["Vendor Advisory","X Refsource SUSE"]},{"url":"http://www.securitytracker.com/id?1018763","label":"www.securitytracker.com/id?1018763","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"http://secunia.com/advisories/28542","label":"secunia.com/advisories/28542","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-66-200642-1","label":"sunsolve.sun.com/search/document.do?assetkey=1-66-200642-1","hostname":"sunsolve.sun.com","tags":["Vendor Advisory","X Refsource SUNALERT"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00352.html","label":"www.redhat.com/archives/fedora-package-announce/2007-December/msg00352.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"http://www.securityfocus.com/archive/1/481432/100/0/threaded","label":"www.securityfocus.com/archive/1/481432/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://bugs.freedesktop.org/show_bug.cgi?id=12299","label":"bugs.freedesktop.org/show_bug.cgi?id=12299","hostname":"bugs.freedesktop.org","tags":["X Refsource CONFIRM"]},{"url":"http://secunia.com/advisories/28514","label":"secunia.com/advisories/28514","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/27052","label":"secunia.com/advisories/27052","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=602","label":"labs.idefense.com/intelligence/vulnerabilities/display.php?id=602","hostname":"labs.idefense.com","tags":["Third Party Advisory","X Refsource IDEFENSE"]},{"url":"http://secunia.com/advisories/27060","label":"secunia.com/advisories/27060","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.vupen.com/english/advisories/2008/0924/references","label":"www.vupen.com/english/advisories/2008/0924/references","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01323725","label":"h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01323725","hostname":"h20000.www2.hp.com","tags":["Vendor Advisory","X Refsource HP"]},{"url":"http://lists.freedesktop.org/archives/xorg-announce/2007-October/000416.html","label":"lists.freedesktop.org/archives/xorg-announce/2007-October/000416.html","hostname":"lists.freedesktop.org","tags":["Mailing List","X Refsource MLIST"]},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0029.html","label":"www.redhat.com/support/errata/RHSA-2008-0029.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://secunia.com/advisories/28004","label":"secunia.com/advisories/28004","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/27240","label":"secunia.com/advisories/27240","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"https://issues.rpath.com/browse/RPL-1756","label":"issues.rpath.com/browse/RPL-1756","hostname":"issues.rpath.com","tags":["X Refsource CONFIRM"]},{"url":"http://secunia.com/advisories/29420","label":"secunia.com/advisories/29420","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/27040","label":"secunia.com/advisories/27040","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html","label":"lists.apple.com/archives/security-announce/2008/Mar/msg00001.html","hostname":"lists.apple.com","tags":["Vendor Advisory","X Refsource APPLE"]},{"url":"http://secunia.com/advisories/27176","label":"secunia.com/advisories/27176","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://security.gentoo.org/glsa/glsa-200710-11.xml","label":"security.gentoo.org/glsa/glsa-200710-11.xml","hostname":"security.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO"]},{"url":"http://secunia.com/advisories/27228","label":"secunia.com/advisories/27228","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.vupen.com/english/advisories/2007/3467","label":"www.vupen.com/english/advisories/2007/3467","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0030.html","label":"www.redhat.com/support/errata/RHSA-2008-0030.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-103114-1","label":"sunsolve.sun.com/search/document.do?assetkey=1-26-103114-1","hostname":"sunsolve.sun.com","tags":["Vendor Advisory","X Refsource SUNALERT"]},{"url":"http://www.vupen.com/english/advisories/2008/0149","label":"www.vupen.com/english/advisories/2008/0149","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://www.mandriva.com/security/advisories?name=MDKSA-2007:210","label":"www.mandriva.com/security/advisories?name=MDKSA-2007:210","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA"]},{"url":"http://www.securityfocus.com/bid/25898","label":"www.securityfocus.com/bid/25898","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"http://bugs.gentoo.org/show_bug.cgi?id=194606","label":"bugs.gentoo.org/show_bug.cgi?id=194606","hostname":"bugs.gentoo.org","tags":["X Refsource CONFIRM"]},{"url":"http://www.vupen.com/english/advisories/2007/3338","label":"www.vupen.com/english/advisories/2007/3338","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://secunia.com/advisories/27560","label":"secunia.com/advisories/27560","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11599","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11599","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]},{"url":"http://docs.info.apple.com/article.html?artnum=307562","label":"docs.info.apple.com/article.html?artnum=307562","hostname":"docs.info.apple.com","tags":["X Refsource CONFIRM"]},{"url":"http://www.vupen.com/english/advisories/2007/3337","label":"www.vupen.com/english/advisories/2007/3337","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/36920","label":"exchange.xforce.ibmcloud.com/vulnerabilities/36920","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://secunia.com/advisories/28536","label":"secunia.com/advisories/28536","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]}],"lineage":{"upstream":[],"downstream":["DSA-1385-1","RHSA-2008:0029","RHSA-2008:0030"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2007-10-05T21:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T15:17:27.847Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":32,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T10:39:46.354Z","stale":false,"partial":false}}