[Bug 1475396] New: CVE-2017-11576 fontforge: Does not ensure a positive size in a weight vector memcpy call in readcfftopdict function

https://bugzilla.redhat.com/show_bug.cgi?id=1475396

            Bug ID: 1475396
           Summary: CVE-2017-11576 fontforge: Does not ensure a positive
                    size in a weight vector memcpy call in readcfftopdict
                    function
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: low
          Priority: low
          Assignee: security-response-team(a)redhat.com
          Reporter: anemec(a)redhat.com
                CC: eng-i18n-bugs(a)redhat.com,
                    fonts-bugs(a)lists.fedoraproject.org, kevin(a)scrye.com,
                    paul(a)frixxon.co.uk, pnemade(a)redhat.com




FontForge 20161012 does not ensure a positive size in a weight vector memcpy
call in readcfftopdict (parsettf.c) resulting in DoS via a crafted otf file.

Upstream issue:

https://github.com/fontforge/fontforge/issues/3091

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1475396] CVE-2017-11576 fontforge: Does not ensure a positive size in a weight vector memcpy call in readcfftopdict function

https://bugzilla.redhat.com/show_bug.cgi?id=1475396

Andrej Nemec <anemec(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |WONTFIX
        Last Closed|                            |2017-07-26 10:44:19



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1475396] CVE-2017-11576 fontforge: Does not ensure a positive size in a weight vector memcpy call in readcfftopdict function

https://bugzilla.redhat.com/show_bug.cgi?id=1475396

Andrej Nemec <anemec(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1475398



--- Comment #1 from Andrej Nemec <anemec(a)redhat.com&gt; ---
Created fontforge tracking bugs for this issue:

Affects: fedora-all [bug 1475398]


Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1475398
[Bug 1475398] CVE-2017-11568 CVE-2017-11569 CVE-2017-11570 CVE-2017-11571
CVE-2017-11572 CVE-2017-11573 CVE-2017-11574 CVE-2017-11575 CVE-2017-11576
CVE-2017-11577 fontforge: various flaws [fedora-all]
-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1475396] CVE-2017-11576 fontforge: Does not ensure a positive size in a weight vector memcpy call in readcfftopdict function

https://bugzilla.redhat.com/show_bug.cgi?id=1475396



--- Comment #2 from Parag Nemade <pnemade(a)redhat.com&gt; ---
Fixed in rawhide build fontforge-20170731-1.fc27

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1475396] CVE-2017-11576 fontforge: Does not ensure a positive size in a weight vector memcpy call in readcfftopdict function

https://bugzilla.redhat.com/show_bug.cgi?id=1475396
Bug 1475396 depends on bug 1475398, which changed state.

Bug 1475398 Summary: CVE-2017-11568 CVE-2017-11569 CVE-2017-11570 CVE-2017-11571
CVE-2017-11572 CVE-2017-11573 CVE-2017-11574 CVE-2017-11575 CVE-2017-11576 CVE-2017-11577
fontforge: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1475398

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |NEXTRELEASE



-- 
You are receiving this mail because:
You are on the CC list for the bug.