[Bug 1191093] New: CVE-2014-9670 freetype: Multiple integer signedness errors in the pcf_get_encodings function inpcf/pcfread.c

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191093

Bug ID: 1191093
           Summary: CVE-2014-9670 freetype: Multiple integer signedness
                    errors in the pcf_get_encodings function
                    inpcf/pcfread.c
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail],
                    [e-mail],
                    [e-mail], [e-mail]

Common Vulnerabilities and Exposures assigned CVE-2014-9670 to the following
issue:

Multiple integer signedness errors in the pcf_get_encodings function in
pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial
of service (integer overflow, NULL pointer dereference, and application crash)
via a crafted PCF file that specifies negative values for the first column and
first row.

http://code.google.com/p/google-security-research/issues/detail?id=158
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=ef1eba751...

[Bug 1191093] CVE-2014-9670 freetype: Multiple integer signedness errors in the pcf_get_encodings function inpcf/pcfread.c

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191093

Vasyl Kaigorodov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1191099

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1191099
[Bug 1191099] CVE-2014-9656 CVE-2014-9657 CVE-2014-9661 CVE-2014-9660
CVE-2014-9667 CVE-2014-9666 CVE-2014-9665 CVE-2014-9664 CVE-2014-9669
CVE-2014-9668 CVE-2014-9662 CVE-2014-9658 CVE-2014-9659 CVE-2014-9663
freetype: various flaws [fedora-all]

[Bug 1191093] CVE-2014-9670 freetype: Multiple integer signedness errors in the pcf_get_encodings function inpcf/pcfread.c

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191093

--- Comment #1 from Vasyl Kaigorodov  ---

Created freetype tracking bugs for this issue:

Affects: fedora-all [bug 1191099]

[Bug 1191093] CVE-2014-9670 freetype: Multiple integer signedness errors in the pcf_get_encodings function inpcf/pcfread.c

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191093

Vasyl Kaigorodov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1191102

[Bug 1191093] CVE-2014-9670 freetype: Multiple integer signedness errors in the pcf_get_encodings function inpcf/pcfread.c

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191093
Bug 1191093 depends on bug 1191099, which changed state.

Bug 1191099 Summary: CVE-2014-9656 CVE-2014-9657 CVE-2014-9661 CVE-2014-9660 CVE-2014-9667 CVE-2014-9666 CVE-2014-9665 CVE-2014-9664 CVE-2014-9669 CVE-2014-9668 CVE-2014-9662 CVE-2014-9658 CVE-2014-9659 CVE-2014-9663 CVE-2014-9670 freetype: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1191099

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
         Resolution|---                         |ERRATA

[Bug 1191093] CVE-2014-9670 freetype: Multiple integer signedness errors in the pcf_get_encodings function inpcf/pcfread.c

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191093

--- Comment #2 from Fedora Update System  ---
freetype-2.5.3-15.fc21 has been pushed to the Fedora 21 stable repository.  If
problems still persist, please make note of it in this bug report.

[Bug 1191093] CVE-2014-9670 freetype: Multiple integer signedness errors in the pcf_get_encodings function inpcf/pcfread.c

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191093

--- Comment #3 from Fedora Update System  ---
freetype-2.5.0-9.fc20 has been pushed to the Fedora 20 stable repository.  If
problems still persist, please make note of it in this bug report.

[Bug 1191093] CVE-2014-9670 freetype: integer overflow in pcf_get_encodings() leading to NULL pointer dereference

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191093

Tomas Hoger  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|medium                      |low
   Fixed In Version|                            |freetype 2.5.4
            Summary|CVE-2014-9670 freetype:     |CVE-2014-9670 freetype:
                   |Multiple integer signedness |integer overflow in
                   |errors in the               |pcf_get_encodings() leading
                   |pcf_get_encodings function  |to NULL pointer dereference
                   |inpcf/pcfread.c             |
         Whiteboard|impact=moderate,public=2014 |impact=low,public=20141124,
                   |1124,reported=20150210,sour |reported=20150210,source=cv
                   |ce=cve,cvss2=3.7/AV:L/AC:H/ |e,cvss2=4.3/AV:N/AC:M/Au:N/
                   |Au:N/C:P/I:P/A:P,fedora-all |C:N/I:N/A:P,cwe=CWE-190->CW
                   |/freetype=affected,rhel-5/f |E-476,rhel-4/freetype=wontf
                   |reetype=new,rhel-6/freetype |ix,rhel-5/freetype=wontfix,
                   |=new,rhel-7/freetype=new    |rhel-6/freetype=affected,rh
                   |                            |el-7/freetype=affected,rhev
                   |                            |-m-3/mingw-virt-viewer=affe
                   |                            |cted,fedora-all/freetype=af
                   |                            |fected,fedora-all/mingw-fre
                   |                            |etype=affected,epel-7/mingw
                   |                            |-freetype=affected
           Severity|medium                      |low

--- Comment #4 from Tomas Hoger  ---
Upstream bug is:
https://savannah.nongnu.org/bugs/?43548

Issue was fixed upstream in 2.5.4.

Affected code reads 4 short values from the input file.  There are 2 "pairs",
for which difference is computed and 1 added to the difference (basically: last
- first + 1).  Results are multiplied together to produce the number of
encodings.  Resulting value is in the range of 32bit signed integer (-2^31 to
2^31-1).  Negative values cause freetype memory allocation function to return
error, which causes pcf_get_encodings() to exit early.  The value of 0 causes
memory allocation function to return NULL, which is later dereferenced, leading
to crash.  Positive values are ok.  As value of each operand of the
multiplication can not exceed 65536 (i.e. 2^16), result can not exceed 2^32. 
Therefore, this can not lead to allocation of a too small buffer that is later
overflown.  Hence there is no memory corruption / code execution impact.

Note that the integer signedness issue mentioned in the upstream report does
not seem relevant.  The same would be possible if first* and last* variables
were unsigned.

Also noted that the NULL pointer dereference occurs in the code introduced by
this commit:

http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0eb6316f

which was added in upstream version 2.4.12.  It does not seem to be possible to
trigger NULL pointer dereference in earlier versions, hence this does not seem
to have any practical impact on the freetype packages in Red Hat Enterprise
Linux 7 and earlier.

[Bug 1191093] CVE-2014-9670 freetype: integer overflow in pcf_get_encodings() leading to NULL pointer dereference

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191093

Martin Prpic  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1197737

[Bug 1191093] CVE-2014-9670 freetype: integer overflow in pcf_get_encodings() leading to NULL pointer dereference

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191093

Martin Prpic  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1197738

[Bug 1191093] CVE-2014-9670 freetype: integer overflow in pcf_get_encodings() leading to NULL pointer dereference

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191093

Martin Prpic  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1197739

[Bug 1191093] CVE-2014-9670 freetype: integer overflow in pcf_get_encodings() leading to NULL pointer dereference

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191093

Martin Prpic  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1197740

[Bug 1191093] CVE-2014-9670 freetype: integer overflow in pcf_get_encodings() leading to NULL pointer dereference

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191093

--- Comment #7 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2015:0696 https://rhn.redhat.com/errata/RHSA-2015-0696.html

[Bug 1191093] CVE-2014-9670 freetype: integer overflow in pcf_get_encodings() leading to NULL pointer dereference

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191093

Tomas Hoger  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |ERRATA
        Last Closed|                            |2015-03-18 03:40:49

[Bug 1191093] CVE-2014-9670 freetype: integer overflow in pcf_get_encodings() leading to NULL pointer dereference

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191093

Vincent Danen  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Whiteboard|impact=low,public=20141124, |impact=low,public=20141124,
                   |reported=20150210,source=cv |reported=20150210,source=cv
                   |e,cvss2=4.3/AV:N/AC:M/Au:N/ |e,cvss2=4.3/AV:N/AC:M/Au:N/
                   |C:N/I:N/A:P,cwe=CWE-190->CW |C:N/I:N/A:P,cwe=CWE-190->CW
                   |E-476,rhel-4/freetype=wontf |E-476,rhel-4/freetype=wontf
                   |ix,rhel-5/freetype=wontfix, |ix,rhel-5/freetype=wontfix,
                   |rhel-6/freetype=affected,rh |rhel-6/freetype=notaffected
                   |el-7/freetype=affected,rhev |,rhel-7/freetype=affected,r
                   |-m-3/mingw-virt-viewer=affe |hev-m-3/mingw-virt-viewer=a
                   |cted,fedora-all/freetype=af |ffected,fedora-all/freetype
                   |fected,fedora-all/mingw-fre |=affected,fedora-all/mingw-
                   |etype=affected,epel-7/mingw |freetype=affected,epel-7/mi
                   |-freetype=affected          |ngw-freetype=affected

[Bug 1191093] CVE-2014-9670 freetype: integer overflow in pcf_get_encodings() leading to NULL pointer dereference

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191093

Ján Rusnačko  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Whiteboard|impact=low,public=20141124, |impact=low,public=20141124,
                   |reported=20150210,source=cv |reported=20150210,source=cv
                   |e,cvss2=4.3/AV:N/AC:M/Au:N/ |e,cvss2=4.3/AV:N/AC:M/Au:N/
                   |C:N/I:N/A:P,cwe=CWE-190->CW |C:N/I:N/A:P,cwe=CWE-190->CW
                   |E-476,rhel-4/freetype=wontf |E-476,rhel-4/freetype=wontf
                   |ix,rhel-5/freetype=wontfix, |ix,rhel-5/freetype=wontfix,
                   |rhel-6/freetype=notaffected |rhel-6/freetype=affected,rh
                   |,rhel-7/freetype=affected,r |el-7/freetype=affected,rhev
                   |hev-m-3/mingw-virt-viewer=a |-m-3/mingw-virt-viewer=affe
                   |ffected,fedora-all/freetype |cted,fedora-all/freetype=af
                   |=affected,fedora-all/mingw- |fected,fedora-all/mingw-fre
                   |freetype=affected,epel-7/mi |etype=affected,epel-7/mingw
                   |ngw-freetype=affected       |-freetype=affected