[Bug 1191094] New: CVE-2014-9671 freetype: Off-by-one error in the pcf_get_properties function in pcf/pcfread.c

List overview All Threads
Download

newer

older

[Bug 1191192] New: CVE-2014-9675...

[Bug 1191096] New: CVE-2014-9673...

Red Hat Bugzilla

10 Feb 2015 10 Feb '15

6:52 a.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1191094

Bug ID: 1191094 Summary: CVE-2014-9671 freetype: Off-by-one error in the pcf_get_properties function in pcf/pcfread.c Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: vkaigoro@redhat.com CC: behdad@fedoraproject.org, fonts-bugs@lists.fedoraproject.org, kevin@tigcc.ticalc.org, mkasik@redhat.com

Common Vulnerabilities and Exposures assigned CVE-2014-9671 to the following issue:

Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PCF file with a 0xffffffff size value that is improperly incremented.

http://code.google.com/p/google-security-research/issues/detail?id=157 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0e2f5d518...

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Kh2uxQYUM7&a=cc_unsubscribe

Show replies by date

Red Hat Bugzilla

10 Feb 10 Feb

6:58 a.m.

New subject: [Bug 1191094] CVE-2014-9671 freetype: Off-by-one error in the pcf_get_properties function in pcf/pcfread.c

https://bugzilla.redhat.com/show_bug.cgi?id=1191094

Vasyl Kaigorodov vkaigoro@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1191099

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1191099 [Bug 1191099] CVE-2014-9656 CVE-2014-9657 CVE-2014-9661 CVE-2014-9660 CVE-2014-9667 CVE-2014-9666 CVE-2014-9665 CVE-2014-9664 CVE-2014-9669 CVE-2014-9668 CVE-2014-9662 CVE-2014-9658 CVE-2014-9659 CVE-2014-9663 CVE-2014-9670 freetype: various flaws [fedora-all]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=HOK4oCmXsn&a=cc_unsubscribe

Red Hat Bugzilla

7 a.m.

New subject: [Bug 1191094] CVE-2014-9671 freetype: Off-by-one error in the pcf_get_properties function in pcf/pcfread.c

https://bugzilla.redhat.com/show_bug.cgi?id=1191094

Vasyl Kaigorodov vkaigoro@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1191102

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=iWhGYFBj30&a=cc_unsubscribe

Red Hat Bugzilla

19 Feb 19 Feb

noon

New subject: [Bug 1191094] CVE-2014-9671 freetype: Off-by-one error in the pcf_get_properties function in pcf/pcfread.c

https://bugzilla.redhat.com/show_bug.cgi?id=1191094 Bug 1191094 depends on bug 1191099, which changed state.

Bug 1191099 Summary: CVE-2014-9656 CVE-2014-9657 CVE-2014-9661 CVE-2014-9660 CVE-2014-9667 CVE-2014-9666 CVE-2014-9665 CVE-2014-9664 CVE-2014-9669 CVE-2014-9668 CVE-2014-9662 CVE-2014-9658 CVE-2014-9659 CVE-2014-9663 CVE-2014-9670 freetype: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1191099

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=iAjwPeynvp&a=cc_unsubscribe

Red Hat Bugzilla

23 Feb 23 Feb

8:53 a.m.

New subject: [Bug 1191094] CVE-2014-9671 freetype: integer overflow in pcf_get_encodings() leading to NULL pointer dereference

https://bugzilla.redhat.com/show_bug.cgi?id=1191094

Tomas Hoger thoger@redhat.com changed:

--- Comment #1 from Tomas Hoger thoger@redhat.com --- Upstream bug is: https://savannah.nongnu.org/bugs/?43547

Issue was fixed upstream in 2.5.4.

This is an integer overflow issue, rather than off-by-one. A string_size value is read from input font file. If value 0xffffffff is used and later 1 is added to it when FT_NEW_ARRAY() is called to allocate strings[] buffer, the addition will overflow (32bit overflow) and leads to attempt to allocate zero sized buffer. Freetype memory allocation functions return NULL in that case, which leads to crash when the buffer is populated later.

Note that this issue was introduced by the CVE-2012-1130 fix (see bug 800587) in the following commit:

http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=c776fc17

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=u9Jm2RfmwU&a=cc_unsubscribe

Red Hat Bugzilla

24 Feb 24 Feb

8:22 a.m.

New subject: [Bug 1191094] CVE-2014-9671 freetype: integer overflow in pcf_get_properties() leading to NULL pointer dereference

https://bugzilla.redhat.com/show_bug.cgi?id=1191094

Tomas Hoger thoger@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=G7bVT3eYXY&a=cc_unsubscribe

Red Hat Bugzilla

8:25 a.m.

New subject: [Bug 1191094] CVE-2014-9671 freetype: integer overflow in pcf_get_properties() leading to NULL pointer dereference

https://bugzilla.redhat.com/show_bug.cgi?id=1191094

--- Comment #4 from Tomas Hoger thoger@redhat.com --- The fix for this issue was found to introduce a regression that prevented loading of certain PCF fonts. Upstream bug and fix:

https://savannah.nongnu.org/bugs/?43774 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=74af85c4b... http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=06842c7b4...

Reported for Fedora in bug 1195652.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ENcqzRIXCm&a=cc_unsubscribe

Red Hat Bugzilla

2 Mar 2 Mar

8:08 a.m.

New subject: [Bug 1191094] CVE-2014-9671 freetype: integer overflow in pcf_get_properties() leading to NULL pointer dereference

https://bugzilla.redhat.com/show_bug.cgi?id=1191094

Martin Prpic mprpic@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1197737

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=byZuMJZL4C&a=cc_unsubscribe

Red Hat Bugzilla

8:08 a.m.

New subject: [Bug 1191094] CVE-2014-9671 freetype: integer overflow in pcf_get_properties() leading to NULL pointer dereference

https://bugzilla.redhat.com/show_bug.cgi?id=1191094

Martin Prpic mprpic@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1197738

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=nbdEkfIRms&a=cc_unsubscribe

Red Hat Bugzilla

8:08 a.m.

New subject: [Bug 1191094] CVE-2014-9671 freetype: integer overflow in pcf_get_properties() leading to NULL pointer dereference

https://bugzilla.redhat.com/show_bug.cgi?id=1191094

Martin Prpic mprpic@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1197739

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=YSorkt9jem&a=cc_unsubscribe

Red Hat Bugzilla

8:09 a.m.

New subject: [Bug 1191094] CVE-2014-9671 freetype: integer overflow in pcf_get_properties() leading to NULL pointer dereference

https://bugzilla.redhat.com/show_bug.cgi?id=1191094

Martin Prpic mprpic@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1197740

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=pbNZAznPIb&a=cc_unsubscribe

Red Hat Bugzilla

17 Mar 17 Mar

12:59 p.m.

New subject: [Bug 1191094] CVE-2014-9671 freetype: integer overflow in pcf_get_properties() leading to NULL pointer dereference

https://bugzilla.redhat.com/show_bug.cgi?id=1191094

--- Comment #6 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7

Via RHSA-2015:0696 https://rhn.redhat.com/errata/RHSA-2015-0696.html

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=X0IwDM6rp1&a=cc_unsubscribe

Red Hat Bugzilla

18 Mar 18 Mar

2:40 a.m.

New subject: [Bug 1191094] CVE-2014-9671 freetype: integer overflow in pcf_get_properties() leading to NULL pointer dereference

https://bugzilla.redhat.com/show_bug.cgi?id=1191094

Tomas Hoger thoger@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=9HFViiFDHk&a=cc_unsubscribe

Red Hat Bugzilla

15 Oct 15 Oct

4:50 p.m.

New subject: [Bug 1191094] CVE-2014-9671 freetype: integer overflow in pcf_get_properties() leading to NULL pointer dereference

https://bugzilla.redhat.com/show_bug.cgi?id=1191094

Vincent Danen vdanen@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=v3uHWWxHMz&a=cc_unsubscribe

Red Hat Bugzilla

25 Nov 25 Nov

4:29 a.m.

New subject: [Bug 1191094] CVE-2014-9671 freetype: integer overflow in pcf_get_properties() leading to NULL pointer dereference

https://bugzilla.redhat.com/show_bug.cgi?id=1191094

Ján Rusnačko jrusnack@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=0RpHx6PChl&a=cc_unsubscribe

3674

Age (days ago)

3962

Last active (days ago)

fonts-bugs@lists.fedoraproject.org

14 comments

1 participants

tags (0)

participants (1)

Red Hat Bugzilla