[Bug 1191096] New: CVE-2014-9673 freetype: Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191096

Bug ID: 1191096
           Summary: CVE-2014-9673 freetype: Integer signedness error in
                    the Mac_Read_POST_Resource function in base/ftobjs.c
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail],
                    [e-mail],
                    [e-mail], [e-mail]

Common Vulnerabilities and Exposures assigned CVE-2014-9673 to the following
issue:

Integer signedness error in the Mac_Read_POST_Resource function in
base/ftobjs.c
in FreeType before 2.5.4 allows remote attackers to cause a denial of service
(heap-based buffer overflow) or possibly have unspecified other impact via a
crafted Mac font.

http://code.google.com/p/google-security-research/issues/detail?id=154
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=35252ae9a...

[Bug 1191096] CVE-2014-9673 freetype: Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191096

Vasyl Kaigorodov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1191102

[Bug 1191096] CVE-2014-9673 freetype: integer signedness error in Mac_Read_POST_Resource() leading to heap-based buffer overflow

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191096

Tomas Hoger  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|medium                      |high
   Fixed In Version|                            |freetype 2.5.4
            Summary|CVE-2014-9673 freetype:     |CVE-2014-9673 freetype:
                   |Integer signedness error in |integer signedness error in
                   |the Mac_Read_POST_Resource  |Mac_Read_POST_Resource()
                   |function in base/ftobjs.c   |leading to heap-based
                   |                            |buffer overflow
         Whiteboard|impact=moderate,public=2014 |impact=important,public=201
                   |1124,reported=20150210,sour |41124,reported=20150210,sou
                   |ce=cve,cvss2=3.7/AV:L/AC:H/ |rce=cve,cvss2=6.8/AV:N/AC:M
                   |Au:N/C:P/I:P/A:P,fedora-all |/Au:N/C:P/I:P/A:P,cwe=CWE-2
                   |/freetype=affected,rhel-5/f |0->CWE-122,rhel-4/freetype=
                   |reetype=new,rhel-6/freetype |wontfix,rhel-5/freetype=aff
                   |=new,rhel-7/freetype=new    |ected,rhel-6/freetype=affec
                   |                            |ted,rhel-7/freetype=affecte
                   |                            |d,rhev-m-3/mingw-virt-viewe
                   |                            |r=affected,fedora-all/freet
                   |                            |ype=affected,fedora-all/min
                   |                            |gw-freetype=affected,epel-7
                   |                            |/mingw-freetype=affected
           Severity|medium                      |high

--- Doc Text *updated* ---
An integer signedness flaw, leading to heap-based buffer overflows, was found in the way FreeType handled Mac fonts. If a specially-crafted font file was loaded by an application linked against FreeType, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.

--- Comment #1 from Tomas Hoger  ---
(Private) upstream bug:
https://savannah.nongnu.org/bugs/?43539

Issue was fixed upstream in 2.5.4.

This issue was reported as being a flaw in the boundary check added to fix
CVE-2010-2808 (see bug 621907) by using negative rlen value.  However, the
check can not be reached with negative rlen, see:

https://code.google.com/p/google-security-research/issues/detail?id=154#c6

There is another signedness issue in the part of the function that computes the
amount of memory needed to store font resources.  Negative resource length
value can lead to insufficient buffer allocation.  However, this issue is
closely related to what was reported as CVE-2014-9674 (bug 1191190).  The
boundary between the issues, and whether they need/should to be treated as
separate CVEs is not obvious.

Complete upstream fix that was applied to address these two issues is noted in
bug 1191190 comment 4.

[Bug 1191096] CVE-2014-9673 freetype: integer signedness error in Mac_Read_POST_Resource() leading to heap-based buffer overflow

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191096

--- Doc Text *updated* by Martin Prpic  ---
An integer signedness flaw, leading to a heap-based buffer overflow, was found in the way FreeType handled Mac fonts. If a specially crafted font file was loaded by an application linked against FreeType, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.

[Bug 1191096] CVE-2014-9673 freetype: integer signedness error in Mac_Read_POST_Resource() leading to heap-based buffer overflow

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191096

Martin Prpic  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Whiteboard|impact=important,public=201 |impact=important,public=201
                   |41124,reported=20150210,sou |41124,reported=20150210,sou
                   |rce=cve,cvss2=6.8/AV:N/AC:M |rce=cve,cvss2=6.8/AV:N/AC:M
                   |/Au:N/C:P/I:P/A:P,cwe=CWE-2 |/Au:N/C:P/I:P/A:P,cwe=CWE-2
                   |0->CWE-122,rhel-4/freetype= |0->CWE-122,rhel-4/freetype=
                   |wontfix,rhel-5/freetype=aff |wontfix,rhel-5/freetype=won
                   |ected,rhel-6/freetype=affec |tfix,rhel-6/freetype=affect
                   |ted,rhel-7/freetype=affecte |ed,rhel-7/freetype=affected
                   |d,rhev-m-3/mingw-virt-viewe |,rhev-m-3/mingw-virt-viewer
                   |r=affected,fedora-all/freet |=affected,fedora-all/freety
                   |ype=affected,fedora-all/min |pe=affected,fedora-all/ming
                   |gw-freetype=affected,epel-7 |w-freetype=affected,epel-7/
                   |/mingw-freetype=affected    |mingw-freetype=affected

[Bug 1191096] CVE-2014-9673 freetype: integer signedness error in Mac_Read_POST_Resource() leading to heap-based buffer overflow

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191096

Martin Prpic  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1197737

[Bug 1191096] CVE-2014-9673 freetype: integer signedness error in Mac_Read_POST_Resource() leading to heap-based buffer overflow

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191096

Martin Prpic  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1197738

[Bug 1191096] CVE-2014-9673 freetype: integer signedness error in Mac_Read_POST_Resource() leading to heap-based buffer overflow

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191096

Martin Prpic  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1197739

[Bug 1191096] CVE-2014-9673 freetype: integer signedness error in Mac_Read_POST_Resource() leading to heap-based buffer overflow

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191096

Martin Prpic  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1197740

[Bug 1191096] CVE-2014-9673 freetype: integer signedness error in Mac_Read_POST_Resource() leading to heap-based buffer overflow

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191096

--- Comment #4 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2015:0696 https://rhn.redhat.com/errata/RHSA-2015-0696.html

[Bug 1191096] CVE-2014-9673 freetype: integer signedness error in Mac_Read_POST_Resource() leading to heap-based buffer overflow

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191096

Tomas Hoger  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |ERRATA
        Last Closed|                            |2015-03-18 03:40:46

[Bug 1191096] CVE-2014-9673 freetype: integer signedness error in Mac_Read_POST_Resource() leading to heap-based buffer overflow

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191096

Vincent Danen  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Whiteboard|impact=important,public=201 |impact=important,public=201
                   |41124,reported=20150210,sou |41124,reported=20150210,sou
                   |rce=cve,cvss2=6.8/AV:N/AC:M |rce=cve,cvss2=6.8/AV:N/AC:M
                   |/Au:N/C:P/I:P/A:P,cwe=CWE-2 |/Au:N/C:P/I:P/A:P,cwe=CWE-2
                   |0->CWE-122,rhel-4/freetype= |0->CWE-122,rhel-4/freetype=
                   |wontfix,rhel-5/freetype=won |wontfix,rhel-5/freetype=won
                   |tfix,rhel-6/freetype=affect |tfix,rhel-6/freetype=notaff
                   |ed,rhel-7/freetype=affected |ected,rhel-7/freetype=affec
                   |,rhev-m-3/mingw-virt-viewer |ted,rhev-m-3/mingw-virt-vie
                   |=affected,fedora-all/freety |wer=affected,fedora-all/fre
                   |pe=affected,fedora-all/ming |etype=affected,fedora-all/m
                   |w-freetype=affected,epel-7/ |ingw-freetype=affected,epel
                   |mingw-freetype=affected     |-7/mingw-freetype=affected

[Bug 1191096] CVE-2014-9673 freetype: integer signedness error in Mac_Read_POST_Resource() leading to heap-based buffer overflow

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191096

Ján Rusnačko  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Whiteboard|impact=important,public=201 |impact=important,public=201
                   |41124,reported=20150210,sou |41124,reported=20150210,sou
                   |rce=cve,cvss2=6.8/AV:N/AC:M |rce=cve,cvss2=6.8/AV:N/AC:M
                   |/Au:N/C:P/I:P/A:P,cwe=CWE-2 |/Au:N/C:P/I:P/A:P,cwe=CWE-2
                   |0->CWE-122,rhel-4/freetype= |0->CWE-122,rhel-4/freetype=
                   |wontfix,rhel-5/freetype=won |wontfix,rhel-5/freetype=won
                   |tfix,rhel-6/freetype=notaff |tfix,rhel-6/freetype=affect
                   |ected,rhel-7/freetype=affec |ed,rhel-7/freetype=affected
                   |ted,rhev-m-3/mingw-virt-vie |,rhev-m-3/mingw-virt-viewer
                   |wer=affected,fedora-all/fre |=affected,fedora-all/freety
                   |etype=affected,fedora-all/m |pe=affected,fedora-all/ming
                   |ingw-freetype=affected,epel |w-freetype=affected,epel-7/
                   |-7/mingw-freetype=affected  |mingw-freetype=affected