[Bug 1752788] New: CVE-2015-9381 freetype: a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c leading to information disclosure
3:40 a.m.
https://bugzilla.redhat.com/show_bug.cgi?id=1752788
Bug ID: 1752788
Summary: CVE-2015-9381 freetype: a heap-based buffer over-read
in T1_Get_Private_Dict in type1/t1parse.c leading to
information disclosure
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mrehak(a)redhat.com
CC: ajax(a)redhat.com, caillon+fedoraproject(a)gmail.com,
fonts-bugs(a)lists.fedoraproject.org,
gnome-sig(a)lists.fedoraproject.org,
john.j5live(a)gmail.com, kevin(a)tigcc.ticalc.org,
mclasen(a)redhat.com, mkasik(a)redhat.com,
rhughes(a)redhat.com, rstrode(a)redhat.com,
sandmann(a)redhat.com
Target Milestone: ---
Classification: Other
FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict
in type1/t1parse.c.
--
You are receiving this mail because:
You are on the CC list for the bug.
3:41 a.m.
New subject: [Bug 1752788] CVE-2015-9381 freetype: a heap-based buffer over-read
in T1_Get_Private_Dict in type1/t1parse.c leading to information disclosure
https://bugzilla.redhat.com/show_bug.cgi?id=1752788
--- Comment #1 from Marian Rehak <mrehak(a)redhat.com> ---
Upstream patch:
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/src/type1/...
--
You are receiving this mail because:
You are on the CC list for the bug.
3:41 a.m.
New subject: [Bug 1752788] CVE-2015-9381 freetype: a heap-based buffer over-read
in T1_Get_Private_Dict in type1/t1parse.c leading to information disclosure
https://bugzilla.redhat.com/show_bug.cgi?id=1752788
Marian Rehak <mrehak(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |1752789
--
You are receiving this mail because:
You are on the CC list for the bug.
10:51 p.m.
New subject: [Bug 1752788] CVE-2015-9381 freetype: a heap-based buffer over-read
in T1_Get_Private_Dict in type1/t1parse.c leading to information disclosure
https://bugzilla.redhat.com/show_bug.cgi?id=1752788
--- Comment #2 from Huzaifa S. Sidhpurwala <huzaifas(a)redhat.com> ---
Upstream bug (along with reproducer) at:
https://savannah.nongnu.org/bugs/?45955
--
You are receiving this mail because:
You are on the CC list for the bug.
10:55 p.m.
New subject: [Bug 1752788] CVE-2015-9381 freetype: a heap-based buffer over-read
in T1_Get_Private_Dict in type1/t1parse.c leading to information disclosure
https://bugzilla.redhat.com/show_bug.cgi?id=1752788
Huzaifa S. Sidhpurwala <huzaifas(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1758402
--
You are receiving this mail because:
You are on the CC list for the bug.
5:05 a.m.
New subject: [Bug 1752788] CVE-2015-9381 freetype: a heap-based buffer over-read
in T1_Get_Private_Dict in type1/t1parse.c leading to information disclosure
https://bugzilla.redhat.com/show_bug.cgi?id=1752788
--- Comment #5 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6
Via RHSA-2019:4254 https://access.redhat.com/errata/RHSA-2019:4254
--
You are receiving this mail because:
You are on the CC list for the bug.
5:05 a.m.
New subject: [Bug 1752788] CVE-2015-9381 freetype: a heap-based buffer over-read
in T1_Get_Private_Dict in type1/t1parse.c leading to information disclosure
https://bugzilla.redhat.com/show_bug.cgi?id=1752788
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2019:4254
--
You are receiving this mail because:
You are on the CC list for the bug.
8:09 a.m.
New subject: [Bug 1752788] CVE-2015-9381 freetype: a heap-based buffer over-read
in T1_Get_Private_Dict in type1/t1parse.c leading to information disclosure
https://bugzilla.redhat.com/show_bug.cgi?id=1752788
Product Security DevOps Team <prodsec-dev(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |ERRATA
Last Closed| |2019-12-17 14:09:23
--- Comment #6 from Product Security DevOps Team <prodsec-dev(a)redhat.com> ---
This bug is now closed. Further updates for individual products will be
reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2015-9381
--
You are receiving this mail because:
You are on the CC list for the bug.
7:48 a.m.
New subject: [Bug 1752788] CVE-2015-9381 freetype: a heap-based buffer over-read
in T1_Get_Private_Dict in type1/t1parse.c leading to information disclosure
https://bugzilla.redhat.com/show_bug.cgi?id=1752788
--- Doc Text *updated* by Eric Christensen <sparks(a)redhat.com> ---
A heap-based buffer overflow flaw was found in FreeType prior to version 2.6.1.
--
You are receiving this mail because:
You are on the CC list for the bug.
9:19 a.m.
New subject: [Bug 1752788] CVE-2015-9381 freetype: a heap-based buffer over-read
in T1_Get_Private_Dict in type1/t1parse.c leading to crash
https://bugzilla.redhat.com/show_bug.cgi?id=1752788
Marian Rehak <mrehak(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|CVE-2015-9381 freetype: a |CVE-2015-9381 freetype: a
|heap-based buffer over-read |heap-based buffer over-read
|in T1_Get_Private_Dict in |in T1_Get_Private_Dict in
|type1/t1parse.c leading to |type1/t1parse.c leading to
|information disclosure |crash
--
You are receiving this mail because:
You are on the CC list for the bug.
9:22 a.m.
New subject: [Bug 1752788] CVE-2015-9381 freetype: a heap-based buffer over-read
in T1_Get_Private_Dict in type1/t1parse.c leading to crash
https://bugzilla.redhat.com/show_bug.cgi?id=1752788
Marian Rehak <mrehak(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(mrehak(a)redhat.com |
|) |
--
You are receiving this mail because:
You are on the CC list for the bug.
10:30 a.m.
New subject: [Bug 1752788] CVE-2015-9381 freetype: a heap-based buffer over-read
in T1_Get_Private_Dict in type1/t1parse.c leading to crash
https://bugzilla.redhat.com/show_bug.cgi?id=1752788
Eric Christensen <sparks(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |huzaifas(a)redhat.com
Flags| |needinfo?(huzaifas(a)redhat.c
| |om)
--- Doc Text *updated* ---
An out-of-bounds buffer overflow flaw was found in FreeType prior to version 2.6.1.
--
You are receiving this mail because:
You are on the CC list for the bug.
11:11 p.m.
New subject: [Bug 1752788] CVE-2015-9381 freetype: a heap-based buffer over-read
in T1_Get_Private_Dict in type1/t1parse.c leading to crash
https://bugzilla.redhat.com/show_bug.cgi?id=1752788
Huzaifa S. Sidhpurwala <huzaifas(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(huzaifas(a)redhat.c |
|om) |
--
You are receiving this mail because:
You are on the CC list for the bug.
12:04 a.m.
New subject: [Bug 1752788] CVE-2015-9381 freetype: a heap-based buffer over-read
in T1_Get_Private_Dict in type1/t1parse.c leading to crash
https://bugzilla.redhat.com/show_bug.cgi?id=1752788
Huzaifa S. Sidhpurwala <huzaifas(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1966861
--
You are receiving this mail because:
You are on the CC list for the bug.
1058
days inactive
1682
days old
fonts-bugs@lists.fedoraproject.org
13 comments
1 participants
participants (1)
-
bugzilla＠redhat.com