https://bugzilla.redhat.com/show_bug.cgi?id=1191096
Tomas Hoger <thoger(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|medium |high
Fixed In Version| |freetype 2.5.4
Summary|CVE-2014-9673 freetype: |CVE-2014-9673 freetype:
|Integer signedness error in |integer signedness error in
|the Mac_Read_POST_Resource |Mac_Read_POST_Resource()
|function in base/ftobjs.c |leading to heap-based
| |buffer overflow
Whiteboard|impact=moderate,public=2014 |impact=important,public=201
|1124,reported=20150210,sour |41124,reported=20150210,sou
|ce=cve,cvss2=3.7/AV:L/AC:H/ |rce=cve,cvss2=6.8/AV:N/AC:M
|Au:N/C:P/I:P/A:P,fedora-all |/Au:N/C:P/I:P/A:P,cwe=CWE-2
|/freetype=affected,rhel-5/f |0->CWE-122,rhel-4/freetype=
|reetype=new,rhel-6/freetype |wontfix,rhel-5/freetype=aff
|=new,rhel-7/freetype=new |ected,rhel-6/freetype=affec
| |ted,rhel-7/freetype=affecte
| |d,rhev-m-3/mingw-virt-viewe
| |r=affected,fedora-all/freet
| |ype=affected,fedora-all/min
| |gw-freetype=affected,epel-7
| |/mingw-freetype=affected
Severity|medium |high
--- Doc Text *updated* ---
An integer signedness flaw, leading to heap-based buffer overflows, was found in the way
FreeType handled Mac fonts. If a specially-crafted font file was loaded by an application
linked against FreeType, it could cause the application to crash or, potentially, execute
arbitrary code with the privileges of the user running the application.
--- Comment #1 from Tomas Hoger <thoger(a)redhat.com> ---
(Private) upstream bug:
https://savannah.nongnu.org/bugs/?43539
Issue was fixed upstream in 2.5.4.
This issue was reported as being a flaw in the boundary check added to fix
CVE-2010-2808 (see bug 621907) by using negative rlen value. However, the
check can not be reached with negative rlen, see:
https://code.google.com/p/google-security-research/issues/detail?id=154#c6
There is another signedness issue in the part of the function that computes the
amount of memory needed to store font resources. Negative resource length
value can lead to insufficient buffer allocation. However, this issue is
closely related to what was reported as CVE-2014-9674 (bug 1191190). The
boundary between the issues, and whether they need/should to be treated as
separate CVEs is not obvious.
Complete upstream fix that was applied to address these two issues is noted in
bug 1191190 comment 4.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=YqG5LOXDV6&a=cc_unsubscribe