libXfont2-2.0.3 will not process font files via symlinks
Submitted by joh..@..ok.com
Assigned to Xorg Project Team
Link to original bug (#105882)
Description
After upgrading from libXfont2-2.0.1 -> 2.0.3, libXfont2 will no longer process font files.
tinycorelinux has a package system that uses squashfs packages loop mounted and symlinked to the root filesystem. If I overwrite the symlinks with the actual font files then things work as expected.
It appears that this broke things?
Open files with O_NOFOLLOW. (CVE-2017-16611)
A non-privileged X client can instruct X server running under root to open any file by creating own directory with "fonts.dir", "fonts.alias" or any font file being a symbolic link to any other file in the system. X server will then open it. This can be issue with special files such as /dev/watchdog.