[Bug 1191083] New: CVE-2014-9661 freetype: use-after-free in type42/t42parse.c

List overview All Threads
Download

newer

older

[Bug 1191085] New: CVE-2014-9663...

[Bug 1191082] New: CVE-2014-9660...

Red Hat Bugzilla

10 Feb 2015 10 Feb '15

6:50 a.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

Bug ID: 1191083 Summary: CVE-2014-9661 freetype: use-after-free in type42/t42parse.c Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: vkaigoro@redhat.com CC: behdad@fedoraproject.org, fonts-bugs@lists.fedoraproject.org, kevin@tigcc.ticalc.org, mkasik@redhat.com

Common Vulnerabilities and Exposures assigned CVE-2014-9661 to the following issue:

type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font.

http://code.google.com/p/google-security-research/issues/detail?id=187 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=3788187e0... http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=42fcd6693...

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=1QWIwOVd3E&a=cc_unsubscribe

Show replies by date

Red Hat Bugzilla

10 Feb 10 Feb

6:55 a.m.

New subject: [Bug 1191083] CVE-2014-9661 freetype: use-after-free in type42/t42parse.c

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

Vasyl Kaigorodov vkaigoro@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1191099

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1191099 [Bug 1191099] CVE-2014-9656 CVE-2014-9657 CVE-2014-9660 CVE-2014-9658 CVE-2014-9659 freetype: various flaws [fedora-all]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=8sjSYr8wjX&a=cc_unsubscribe

Red Hat Bugzilla

6:56 a.m.

New subject: [Bug 1191083] CVE-2014-9661 freetype: use-after-free in type42/t42parse.c

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

--- Comment #1 from Vasyl Kaigorodov vkaigoro@redhat.com ---

Created freetype tracking bugs for this issue:

Affects: fedora-all [bug 1191099]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=y7RAn8tquc&a=cc_unsubscribe

Red Hat Bugzilla

7 a.m.

New subject: [Bug 1191083] CVE-2014-9661 freetype: use-after-free in type42/t42parse.c

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

Vasyl Kaigorodov vkaigoro@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1191102

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=LVLQv8HR5e&a=cc_unsubscribe

Red Hat Bugzilla

19 Feb 19 Feb

noon

New subject: [Bug 1191083] CVE-2014-9661 freetype: use-after-free in type42/t42parse.c

https://bugzilla.redhat.com/show_bug.cgi?id=1191083 Bug 1191083 depends on bug 1191099, which changed state.

Bug 1191099 Summary: CVE-2014-9656 CVE-2014-9657 CVE-2014-9661 CVE-2014-9660 CVE-2014-9667 CVE-2014-9666 CVE-2014-9665 CVE-2014-9664 CVE-2014-9669 CVE-2014-9668 CVE-2014-9662 CVE-2014-9658 CVE-2014-9659 CVE-2014-9663 CVE-2014-9670 freetype: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1191099

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=A43uSHRMLK&a=cc_unsubscribe

Red Hat Bugzilla

noon

New subject: [Bug 1191083] CVE-2014-9661 freetype: use-after-free in type42/t42parse.c

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

--- Comment #2 from Fedora Update System updates@fedoraproject.org --- freetype-2.5.3-15.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=fyu8B0bpEK&a=cc_unsubscribe

Red Hat Bugzilla

20 Feb 20 Feb

2:30 a.m.

New subject: [Bug 1191083] CVE-2014-9661 freetype: use-after-free in type42/t42parse.c

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

--- Comment #3 from Fedora Update System updates@fedoraproject.org --- freetype-2.5.0-9.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=JPLibfp8mO&a=cc_unsubscribe

Red Hat Bugzilla

6:08 a.m.

New subject: [Bug 1191083] CVE-2014-9661 freetype: out of bounds read in Type42 font parser

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

Tomas Hoger thoger@redhat.com changed:

--- Comment #4 from Tomas Hoger thoger@redhat.com --- Upstream bug is: https://savannah.nongnu.org/bugs/?43659

Issue was fixed upstream in 2.5.4.

This is not really a use-after-free issue. The problem rather here is that ttf_data and ttf_size get out of sync. t42_parse_sfnts() can be called multiple times. On the first call, ttf_data is allocated and ttf_size properly set to its size. On a subsequent call, tff_data re-allocated to be shorter, but ttf_size is not updated to match new ttf_data size. This leads to buffer over-read later. In that processing, valid pointer is used, in combination incorrect value indicating buffer size.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=2CCyUYPgBB&a=cc_unsubscribe

Red Hat Bugzilla

2 Mar 2 Mar

8:03 a.m.

New subject: [Bug 1191083] CVE-2014-9661 freetype: out of bounds read in Type42 font parser

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

Martin Prpic mprpic@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1197737

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=WAKFuuNvEi&a=cc_unsubscribe

Red Hat Bugzilla

8:03 a.m.

New subject: [Bug 1191083] CVE-2014-9661 freetype: out of bounds read in Type42 font parser

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

Martin Prpic mprpic@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1197738

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=MsmnaPxdVQ&a=cc_unsubscribe

Red Hat Bugzilla

8:03 a.m.

New subject: [Bug 1191083] CVE-2014-9661 freetype: out of bounds read in Type42 font parser

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

Martin Prpic mprpic@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1197739

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=oVUdAM2JEZ&a=cc_unsubscribe

Red Hat Bugzilla

8:04 a.m.

New subject: [Bug 1191083] CVE-2014-9661 freetype: out of bounds read in Type42 font parser

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

Martin Prpic mprpic@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1197740

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=UttgtfSxpU&a=cc_unsubscribe

Red Hat Bugzilla

17 Mar 17 Mar

12:58 p.m.

New subject: [Bug 1191083] CVE-2014-9661 freetype: out of bounds read in Type42 font parser

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

--- Comment #7 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7

Via RHSA-2015:0696 https://rhn.redhat.com/errata/RHSA-2015-0696.html

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=5Kfi5mwryD&a=cc_unsubscribe

Red Hat Bugzilla

18 Mar 18 Mar

2:40 a.m.

New subject: [Bug 1191083] CVE-2014-9661 freetype: out of bounds read in Type42 font parser

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

Tomas Hoger thoger@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=eSpeSm0tCK&a=cc_unsubscribe

Red Hat Bugzilla

15 Oct 15 Oct

4:50 p.m.

New subject: [Bug 1191083] CVE-2014-9661 freetype: out of bounds read in Type42 font parser

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

Vincent Danen vdanen@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=S7xXN2GagV&a=cc_unsubscribe

Red Hat Bugzilla

25 Nov 25 Nov

4:28 a.m.

New subject: [Bug 1191083] CVE-2014-9661 freetype: out of bounds read in Type42 font parser

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

Ján Rusnačko jrusnack@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=dC5hUoC87a&a=cc_unsubscribe

3494

Age (days ago)

3782

Last active (days ago)

fonts-bugs@lists.fedoraproject.org

15 comments

1 participants

tags (0)

participants (1)

Red Hat Bugzilla