[Bug 1191086] New: CVE-2014-9664 freetype: out-of-bounds read via a crafted Type42 font

List overview All Threads
Download

newer

older

[Bug 1191090] New: CVE-2014-9667...

[Bug 1191085] New: CVE-2014-9663...

Red Hat Bugzilla

10 Feb 2015 10 Feb '15

2:51 p.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1191086

Bug ID: 1191086 Summary: CVE-2014-9664 freetype: out-of-bounds read via a crafted Type42 font Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: vkaigoro@redhat.com CC: behdad@fedoraproject.org, fonts-bugs@lists.fedoraproject.org, kevin@tigcc.ticalc.org, mkasik@redhat.com

Common Vulnerabilities and Exposures assigned CVE-2014-9664 to the following issue:

FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted Type42 font, related to type42/t42parse.c and type1/t1load.c.

http://code.google.com/p/google-security-research/issues/detail?id=183 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=73be9f9ab... http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=dd89710f0...

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=f9GfIaQbWS&a=cc_unsubscribe

Show replies by date

Red Hat Bugzilla

10 Feb 10 Feb

2:56 p.m.

New subject: [Bug 1191086] CVE-2014-9664 freetype: out-of-bounds read via a crafted Type42 font

https://bugzilla.redhat.com/show_bug.cgi?id=1191086

Vasyl Kaigorodov vkaigoro@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1191099

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1191099 [Bug 1191099] CVE-2014-9656 CVE-2014-9657 CVE-2014-9661 CVE-2014-9660 CVE-2014-9662 CVE-2014-9658 CVE-2014-9659 CVE-2014-9663 freetype: various flaws [fedora-all]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=4mrJqL4A4L&a=cc_unsubscribe

Red Hat Bugzilla

2:56 p.m.

New subject: [Bug 1191086] CVE-2014-9664 freetype: out-of-bounds read via a crafted Type42 font

https://bugzilla.redhat.com/show_bug.cgi?id=1191086

--- Comment #1 from Vasyl Kaigorodov vkaigoro@redhat.com ---

Created freetype tracking bugs for this issue:

Affects: fedora-all [bug 1191099]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=kNpnYMkIOX&a=cc_unsubscribe

Red Hat Bugzilla

3 p.m.

New subject: [Bug 1191086] CVE-2014-9664 freetype: out-of-bounds read via a crafted Type42 font

https://bugzilla.redhat.com/show_bug.cgi?id=1191086

Vasyl Kaigorodov vkaigoro@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1191102

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=pLviaJjItq&a=cc_unsubscribe

Red Hat Bugzilla

19 Feb 19 Feb

8 p.m.

New subject: [Bug 1191086] CVE-2014-9664 freetype: out-of-bounds read via a crafted Type42 font

https://bugzilla.redhat.com/show_bug.cgi?id=1191086 Bug 1191086 depends on bug 1191099, which changed state.

Bug 1191099 Summary: CVE-2014-9656 CVE-2014-9657 CVE-2014-9661 CVE-2014-9660 CVE-2014-9667 CVE-2014-9666 CVE-2014-9665 CVE-2014-9664 CVE-2014-9669 CVE-2014-9668 CVE-2014-9662 CVE-2014-9658 CVE-2014-9659 CVE-2014-9663 CVE-2014-9670 freetype: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1191099

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ucTt9C3nOd&a=cc_unsubscribe

Red Hat Bugzilla

8:01 p.m.

New subject: [Bug 1191086] CVE-2014-9664 freetype: out-of-bounds read via a crafted Type42 font

https://bugzilla.redhat.com/show_bug.cgi?id=1191086

--- Comment #2 from Fedora Update System updates@fedoraproject.org --- freetype-2.5.3-15.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=I4ajEMSrNy&a=cc_unsubscribe

Red Hat Bugzilla

20 Feb 20 Feb

10:30 a.m.

New subject: [Bug 1191086] CVE-2014-9664 freetype: out-of-bounds read via a crafted Type42 font

https://bugzilla.redhat.com/show_bug.cgi?id=1191086

--- Comment #3 from Fedora Update System updates@fedoraproject.org --- freetype-2.5.0-9.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=tc0g11BqSa&a=cc_unsubscribe

Red Hat Bugzilla

23 Feb 23 Feb

11:21 a.m.

New subject: [Bug 1191086] CVE-2014-9664 freetype: off-by-one buffer over-read in parse_charstrings() / t42_parse_charstrings()

https://bugzilla.redhat.com/show_bug.cgi?id=1191086

Tomas Hoger thoger@redhat.com changed:

--- Comment #4 from Tomas Hoger thoger@redhat.com --- Upstream bug is: https://savannah.nongnu.org/bugs/?43655

Issue was fixed upstream in 2.5.4.

This CVE is for multiple off-by-one buffer reads in parse_charstrings() and t42_parse_charstrings(). Probability of this causing a crash is low.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=BFSatnrJf4&a=cc_unsubscribe

Red Hat Bugzilla

2 Mar 2 Mar

4:05 p.m.

New subject: [Bug 1191086] CVE-2014-9664 freetype: off-by-one buffer over-read in parse_charstrings() / t42_parse_charstrings()

https://bugzilla.redhat.com/show_bug.cgi?id=1191086

Martin Prpic mprpic@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1197737

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=VP3bhtYJLa&a=cc_unsubscribe

Red Hat Bugzilla

4:05 p.m.

New subject: [Bug 1191086] CVE-2014-9664 freetype: off-by-one buffer over-read in parse_charstrings() / t42_parse_charstrings()

https://bugzilla.redhat.com/show_bug.cgi?id=1191086

Martin Prpic mprpic@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1197738

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Mt6kWPSAEc&a=cc_unsubscribe

Red Hat Bugzilla

4:05 p.m.

New subject: [Bug 1191086] CVE-2014-9664 freetype: off-by-one buffer over-read in parse_charstrings() / t42_parse_charstrings()

https://bugzilla.redhat.com/show_bug.cgi?id=1191086

Martin Prpic mprpic@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1197739

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=1y85uSPpLd&a=cc_unsubscribe

Red Hat Bugzilla

4:05 p.m.

New subject: [Bug 1191086] CVE-2014-9664 freetype: off-by-one buffer over-read in parse_charstrings() / t42_parse_charstrings()

https://bugzilla.redhat.com/show_bug.cgi?id=1191086

Martin Prpic mprpic@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1197740

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=fNkkkuxQTu&a=cc_unsubscribe

Red Hat Bugzilla

17 Mar 17 Mar

7:59 p.m.

New subject: [Bug 1191086] CVE-2014-9664 freetype: off-by-one buffer over-read in parse_charstrings() / t42_parse_charstrings()

https://bugzilla.redhat.com/show_bug.cgi?id=1191086

--- Comment #7 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7

Via RHSA-2015:0696 https://rhn.redhat.com/errata/RHSA-2015-0696.html

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=JYc5znbruR&a=cc_unsubscribe

Red Hat Bugzilla

18 Mar 18 Mar

9:40 a.m.

New subject: [Bug 1191086] CVE-2014-9664 freetype: off-by-one buffer over-read in parse_charstrings() / t42_parse_charstrings()

https://bugzilla.redhat.com/show_bug.cgi?id=1191086

Tomas Hoger thoger@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=exNGVhfCbA&a=cc_unsubscribe

Red Hat Bugzilla

16 Oct 16 Oct

12:50 a.m.

New subject: [Bug 1191086] CVE-2014-9664 freetype: off-by-one buffer over-read in parse_charstrings() / t42_parse_charstrings()

https://bugzilla.redhat.com/show_bug.cgi?id=1191086

Vincent Danen vdanen@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=MlKvndDx64&a=cc_unsubscribe

Red Hat Bugzilla

25 Nov 25 Nov

12:28 p.m.

New subject: [Bug 1191086] CVE-2014-9664 freetype: off-by-one buffer over-read in parse_charstrings() / t42_parse_charstrings()

https://bugzilla.redhat.com/show_bug.cgi?id=1191086

Ján Rusnačko jrusnack@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=vrvDMnVuV2&a=cc_unsubscribe

3892

Age (days ago)

4180

Last active (days ago)

fonts-bugs@lists.fedoraproject.org

15 comments

1 participants

tags (0)

participants (1)

Red Hat Bugzilla