[Bug 1475398] New: CVE-2017-11568 CVE-2017-11569 CVE-2017-11570 CVE-2017-11571 CVE-2017-11572 CVE-2017-11573 CVE-2017-11574 CVE-2017-11575 CVE-2017-11576 CVE-2017-11577 fontforge : various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1475398
Bug ID: 1475398 Summary: CVE-2017-11568 CVE-2017-11569 CVE-2017-11570 CVE-2017-11571 CVE-2017-11572 CVE-2017-11573 CVE-2017-11574 CVE-2017-11575 CVE-2017-11576 CVE-2017-11577 fontforge: various flaws [fedora-all] Product: Fedora Version: 26 Component: fontforge Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: kevin@scrye.com Reporter: anemec@redhat.com QA Contact: extras-qa@fedoraproject.org CC: fonts-bugs@lists.fedoraproject.org, kevin@scrye.com, paul@frixxon.co.uk, pnemade@redhat.com
This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all.
For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field.
For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate.
https://bugzilla.redhat.com/show_bug.cgi?id=1475398
--- Comment #1 from Andrej Nemec anemec@redhat.com --- Use the following template to for the 'fedpkg update' request to submit an update for this issue as it contains the top-level parent bug(s) as well as this tracking bug. This will ensure that all associated bugs get updated when new packages are pushed to stable.
=====
# bugfix, security, enhancement, newpackage (required) type=security
# testing, stable request=testing
# Bug numbers: 1234,9876 bugs=1475384,1475386,1475388,1475389,1475390,1475391,1475392,1475393,1475396,1475397
# Description of your update notes=Security fix for [PUT CVEs HERE]
# Enable request automation based on the stable/unstable karma thresholds autokarma=True stable_karma=3 unstable_karma=-3
# Automatically close bugs when this marked as stable close_bugs=True
# Suggest that users restart after update suggest_reboot=False
======
Additionally, you may opt to use the bodhi web interface to submit updates:
https://bodhi.fedoraproject.org/updates/new
https://bugzilla.redhat.com/show_bug.cgi?id=1475398
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1475384 (CVE-2017-11568)
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1475384 [Bug 1475384] CVE-2017-11568 fontforge: Heap-buffer over-read in PSCharStringToSplines function
https://bugzilla.redhat.com/show_bug.cgi?id=1475398
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1475396 (CVE-2017-11576)
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1475396 [Bug 1475396] CVE-2017-11576 fontforge: Does not ensure a positive size in a weight vector memcpy call in readcfftopdict function
https://bugzilla.redhat.com/show_bug.cgi?id=1475398
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1475390 (CVE-2017-11572)
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1475390 [Bug 1475390] CVE-2017-11572 fontforge: Heap-based buffer over-read in readcfftopidcts function
https://bugzilla.redhat.com/show_bug.cgi?id=1475398
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1475391 (CVE-2017-11573)
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1475391 [Bug 1475391] CVE-2017-11573 fontforge: Buffer over-read in ValidatePostScriptFontName function
https://bugzilla.redhat.com/show_bug.cgi?id=1475398
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1475389 (CVE-2017-11571)
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1475389 [Bug 1475389] CVE-2017-11571 fontforge: Stack-buffer overflow in addnibble function
https://bugzilla.redhat.com/show_bug.cgi?id=1475398
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1475393 (CVE-2017-11575)
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1475393 [Bug 1475393] CVE-2017-11575 fontforge: Buffer over-read in strnmatch function
https://bugzilla.redhat.com/show_bug.cgi?id=1475398
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1475392 (CVE-2017-11574)
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1475392 [Bug 1475392] CVE-2017-11574 fontforge: Heap-based buffer overflow in readcffset function
https://bugzilla.redhat.com/show_bug.cgi?id=1475398
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1475388 (CVE-2017-11570)
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1475388 [Bug 1475388] CVE-2017-11570 fontforge: Buffer over-read in umodenc function
https://bugzilla.redhat.com/show_bug.cgi?id=1475398
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1475386 (CVE-2017-11569)
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1475386 [Bug 1475386] CVE-2017-11569 fontforge: Heap-buffer over-read in readttfcopyrights function
https://bugzilla.redhat.com/show_bug.cgi?id=1475398
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1475397 (CVE-2017-11577)
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1475397 [Bug 1475397] CVE-2017-11577 fontforge: Buffer over-read in getsid function
https://bugzilla.redhat.com/show_bug.cgi?id=1475398
Parag Nemade pnemade@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |NEXTRELEASE Last Closed| |2018-01-13 23:25:19
--- Comment #2 from Parag Nemade pnemade@redhat.com --- I don't know what policy we have for closing the security bugs but going by general bugzilla workflow as the required fixes are already in Fedora releases, let's close this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1475398
Parag Nemade pnemade@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |fontforge-20170731-1.fc27.x | |86_64
fonts-bugs@lists.fedoraproject.org
-
bugzilla＠redhat.com