[Bug 1191090] New: CVE-2014-9667 freetype: integer overflow and out-of-bounds read in sfnt/ttload.c

List overview All Threads
Download

newer

older

[Bug 1191092] New: CVE-2014-9669...

[Bug 1191086] New: CVE-2014-9664...

Red Hat Bugzilla

10 Feb 2015 10 Feb '15

1:51 p.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1191090

Bug ID: 1191090 Summary: CVE-2014-9667 freetype: integer overflow and out-of-bounds read in sfnt/ttload.c Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: vkaigoro@redhat.com CC: behdad@fedoraproject.org, fonts-bugs@lists.fedoraproject.org, kevin@tigcc.ticalc.org, mkasik@redhat.com

Common Vulnerabilities and Exposures assigned CVE-2014-9667 to the following issue:

sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted SFNT table.

http://code.google.com/p/google-security-research/issues/detail?id=166 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=677ddf4f1...

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=zImGNf0ZHS&a=cc_unsubscribe

Show replies by thread

Red Hat Bugzilla

10 Feb 10 Feb

1:57 p.m.

New subject: [Bug 1191090] CVE-2014-9667 freetype: integer overflow and out-of-bounds read in sfnt/ttload.c

https://bugzilla.redhat.com/show_bug.cgi?id=1191090

Vasyl Kaigorodov vkaigoro@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1191099

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1191099 [Bug 1191099] CVE-2014-9656 CVE-2014-9657 CVE-2014-9661 CVE-2014-9660 CVE-2014-9666 CVE-2014-9665 CVE-2014-9664 CVE-2014-9662 CVE-2014-9658 CVE-2014-9659 CVE-2014-9663 freetype: various flaws [fedora-all]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=4jzSMPmb6z&a=cc_unsubscribe

Red Hat Bugzilla

1:57 p.m.

New subject: [Bug 1191090] CVE-2014-9667 freetype: integer overflow and out-of-bounds read in sfnt/ttload.c

https://bugzilla.redhat.com/show_bug.cgi?id=1191090

--- Comment #1 from Vasyl Kaigorodov vkaigoro@redhat.com ---

Created freetype tracking bugs for this issue:

Affects: fedora-all [bug 1191099]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=J0f4Rg4B7A&a=cc_unsubscribe

Red Hat Bugzilla

2 p.m.

New subject: [Bug 1191090] CVE-2014-9667 freetype: integer overflow and out-of-bounds read in sfnt/ttload.c

https://bugzilla.redhat.com/show_bug.cgi?id=1191090

Vasyl Kaigorodov vkaigoro@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1191102

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=iQ7rX5UObv&a=cc_unsubscribe

Red Hat Bugzilla

19 Feb 19 Feb

7 p.m.

New subject: [Bug 1191090] CVE-2014-9667 freetype: integer overflow and out-of-bounds read in sfnt/ttload.c

https://bugzilla.redhat.com/show_bug.cgi?id=1191090 Bug 1191090 depends on bug 1191099, which changed state.

Bug 1191099 Summary: CVE-2014-9656 CVE-2014-9657 CVE-2014-9661 CVE-2014-9660 CVE-2014-9667 CVE-2014-9666 CVE-2014-9665 CVE-2014-9664 CVE-2014-9669 CVE-2014-9668 CVE-2014-9662 CVE-2014-9658 CVE-2014-9659 CVE-2014-9663 CVE-2014-9670 freetype: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1191099

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=HwwSlWwe7O&a=cc_unsubscribe

Red Hat Bugzilla

7 p.m.

New subject: [Bug 1191090] CVE-2014-9667 freetype: integer overflow and out-of-bounds read in sfnt/ttload.c

https://bugzilla.redhat.com/show_bug.cgi?id=1191090

--- Comment #2 from Fedora Update System updates@fedoraproject.org --- freetype-2.5.3-15.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=wKsYjAT0Iq&a=cc_unsubscribe

Red Hat Bugzilla

20 Feb 20 Feb

9:30 a.m.

New subject: [Bug 1191090] CVE-2014-9667 freetype: integer overflow and out-of-bounds read in sfnt/ttload.c

https://bugzilla.redhat.com/show_bug.cgi?id=1191090

--- Comment #3 from Fedora Update System updates@fedoraproject.org --- freetype-2.5.0-9.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=tnwjI5sFtZ&a=cc_unsubscribe

Red Hat Bugzilla

23 Feb 23 Feb

11:29 a.m.

New subject: [Bug 1191090] CVE-2014-9667 freetype: integer overflow in tt_face_load_font_dir() leading to out-of-bounds read

https://bugzilla.redhat.com/show_bug.cgi?id=1191090

Tomas Hoger thoger@redhat.com changed:

--- Comment #4 from Tomas Hoger thoger@redhat.com --- Upstream bug is: https://savannah.nongnu.org/bugs/?43590

Issue was fixed upstream in 2.5.4.

The issue is an integer overflow flaw in a check protecting against out-of-bounds reads, making it possible to bypass check. Crashing freetype using a specially-crafted font file should be possible because of this.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=LpNkSzLu5I&a=cc_unsubscribe

Red Hat Bugzilla

26 Feb 26 Feb

10:43 a.m.

New subject: [Bug 1191090] CVE-2014-9667 freetype: integer overflow in tt_face_load_font_dir() leading to out-of-bounds read

https://bugzilla.redhat.com/show_bug.cgi?id=1191090

Martin Prpic mprpic@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=5udTdbtGtY&a=cc_unsubscribe

Red Hat Bugzilla

2 Mar 2 Mar

3:06 p.m.

New subject: [Bug 1191090] CVE-2014-9667 freetype: integer overflow in tt_face_load_font_dir() leading to out-of-bounds read

https://bugzilla.redhat.com/show_bug.cgi?id=1191090

Martin Prpic mprpic@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1197737

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=N429RCY8G3&a=cc_unsubscribe

Red Hat Bugzilla

3:06 p.m.

New subject: [Bug 1191090] CVE-2014-9667 freetype: integer overflow in tt_face_load_font_dir() leading to out-of-bounds read

https://bugzilla.redhat.com/show_bug.cgi?id=1191090

Martin Prpic mprpic@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1197738

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=y04CtbrY3N&a=cc_unsubscribe

Red Hat Bugzilla

3:06 p.m.

New subject: [Bug 1191090] CVE-2014-9667 freetype: integer overflow in tt_face_load_font_dir() leading to out-of-bounds read

https://bugzilla.redhat.com/show_bug.cgi?id=1191090

Martin Prpic mprpic@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1197739

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=cHI7xKuW7s&a=cc_unsubscribe

Red Hat Bugzilla

3:06 p.m.

New subject: [Bug 1191090] CVE-2014-9667 freetype: integer overflow in tt_face_load_font_dir() leading to out-of-bounds read

https://bugzilla.redhat.com/show_bug.cgi?id=1191090

Martin Prpic mprpic@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1197740

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=s3jsIfzqtT&a=cc_unsubscribe

Red Hat Bugzilla

17 Mar 17 Mar

6:59 p.m.

New subject: [Bug 1191090] CVE-2014-9667 freetype: integer overflow in tt_face_load_font_dir() leading to out-of-bounds read

https://bugzilla.redhat.com/show_bug.cgi?id=1191090

--- Comment #7 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7

Via RHSA-2015:0696 https://rhn.redhat.com/errata/RHSA-2015-0696.html

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=zOMDnxvzBf&a=cc_unsubscribe

Red Hat Bugzilla

18 Mar 18 Mar

8:40 a.m.

New subject: [Bug 1191090] CVE-2014-9667 freetype: integer overflow in tt_face_load_font_dir() leading to out-of-bounds read

https://bugzilla.redhat.com/show_bug.cgi?id=1191090

Tomas Hoger thoger@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=9XFoPmGW2j&a=cc_unsubscribe

Red Hat Bugzilla

15 Oct 15 Oct

11:50 p.m.

New subject: [Bug 1191090] CVE-2014-9667 freetype: integer overflow in tt_face_load_font_dir() leading to out-of-bounds read

https://bugzilla.redhat.com/show_bug.cgi?id=1191090

Vincent Danen vdanen@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=QL5UvHQ551&a=cc_unsubscribe

Red Hat Bugzilla

25 Nov 25 Nov

11:28 a.m.

New subject: [Bug 1191090] CVE-2014-9667 freetype: integer overflow in tt_face_load_font_dir() leading to out-of-bounds read

https://bugzilla.redhat.com/show_bug.cgi?id=1191090

Ján Rusnačko jrusnack@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=mYy0wjZHNR&a=cc_unsubscribe

3703

Age (days ago)

3991

Last active (days ago)

fonts-bugs@lists.fedoraproject.org

16 comments

1 participants

tags (0)

participants (1)

Red Hat Bugzilla