[Bug 1191083] New: CVE-2014-9661 freetype: use-after-free in type42/t42parse.c

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

            Bug ID: 1191083
           Summary: CVE-2014-9661 freetype: use-after-free in
                    type42/t42parse.c
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: security-response-team(a)redhat.com
          Reporter: vkaigoro(a)redhat.com
                CC: behdad(a)fedoraproject.org,
                    fonts-bugs(a)lists.fedoraproject.org,
                    kevin(a)tigcc.ticalc.org, mkasik(a)redhat.com



Common Vulnerabilities and Exposures assigned CVE-2014-9661 to the following
issue:

type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can
be incomplete without triggering an error, which allows remote attackers to
cause a denial of service (use-after-free) or possibly have unspecified other
impact via a crafted Type42 font.

http://code.google.com/p/google-security-research/issues/detail?id=187
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=378818...
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=42fcd6...

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=1QWIwOVd3E&a=cc_unsubscribe

[Bug 1191083] CVE-2014-9661 freetype: use-after-free in type42/t42parse.c

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

Vasyl Kaigorodov <vkaigoro(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1191099




Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1191099
[Bug 1191099] CVE-2014-9656 CVE-2014-9657 CVE-2014-9660 CVE-2014-9658
CVE-2014-9659 freetype: various flaws [fedora-all]
-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=8sjSYr8wjX&a=cc_unsubscribe

[Bug 1191083] CVE-2014-9661 freetype: use-after-free in type42/t42parse.c

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191083



--- Comment #1 from Vasyl Kaigorodov <vkaigoro(a)redhat.com&gt; ---

Created freetype tracking bugs for this issue:

Affects: fedora-all [bug 1191099]

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=y7RAn8tquc&a=cc_unsubscribe

[Bug 1191083] CVE-2014-9661 freetype: use-after-free in type42/t42parse.c

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

Vasyl Kaigorodov <vkaigoro(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1191102



-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=LVLQv8HR5e&a=cc_unsubscribe

[Bug 1191083] CVE-2014-9661 freetype: use-after-free in type42/t42parse.c

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191083
Bug 1191083 depends on bug 1191099, which changed state.

Bug 1191099 Summary: CVE-2014-9656 CVE-2014-9657 CVE-2014-9661 CVE-2014-9660 CVE-2014-9667
CVE-2014-9666 CVE-2014-9665 CVE-2014-9664 CVE-2014-9669 CVE-2014-9668 CVE-2014-9662
CVE-2014-9658 CVE-2014-9659 CVE-2014-9663 CVE-2014-9670 freetype: various flaws
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1191099

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
         Resolution|---                         |ERRATA



-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=A43uSHRMLK&a=cc_unsubscribe

[Bug 1191083] CVE-2014-9661 freetype: use-after-free in type42/t42parse.c

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191083



--- Comment #2 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
freetype-2.5.3-15.fc21 has been pushed to the Fedora 21 stable repository.  If
problems still persist, please make note of it in this bug report.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=fyu8B0bpEK&a=cc_unsubscribe

[Bug 1191083] CVE-2014-9661 freetype: use-after-free in type42/t42parse.c

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191083



--- Comment #3 from Fedora Update System <updates(a)fedoraproject.org&gt; ---
freetype-2.5.0-9.fc20 has been pushed to the Fedora 20 stable repository.  If
problems still persist, please make note of it in this bug report.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=JPLibfp8mO&a=cc_unsubscribe

[Bug 1191083] CVE-2014-9661 freetype: out of bounds read in Type42 font parser

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

Tomas Hoger <thoger(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|medium                      |low
   Fixed In Version|                            |freetype 2.5.4
            Summary|CVE-2014-9661 freetype:     |CVE-2014-9661 freetype: out
                   |use-after-free in           |of bounds read in Type42
                   |type42/t42parse.c           |font parser
         Whiteboard|impact=moderate,public=2014 |impact=low,public=20141124,
                   |1124,reported=20150210,sour |reported=20150210,source=cv
                   |ce=cve,cvss2=3.7/AV:L/AC:H/ |e,cvss2=4.3/AV:N/AC:M/Au:N/
                   |Au:N/C:P/I:P/A:P,fedora-all |C:N/I:N/A:P,cwe=CWE-125,rhe
                   |/freetype=affected,rhel-5/f |l-5/freetype=wontfix,rhel-6
                   |reetype=new,rhel-6/freetype |/freetype=affected,rhel-7/f
                   |=new,rhel-7/freetype=new    |reetype=affected,rhev-m-3/m
                   |                            |ingw-virt-viewer=affected,f
                   |                            |edora-all/freetype=affected
                   |                            |,fedora-all/mingw-freetype=
                   |                            |affected,epel-7/mingw-freet
                   |                            |ype=affected
           Severity|medium                      |low



--- Comment #4 from Tomas Hoger <thoger(a)redhat.com&gt; ---
Upstream bug is:
https://savannah.nongnu.org/bugs/?43659

Issue was fixed upstream in 2.5.4.

This is not really a use-after-free issue.  The problem rather here is that
ttf_data and ttf_size get out of sync.  t42_parse_sfnts() can be called
multiple times.  On the first call, ttf_data is allocated and ttf_size properly
set to its size.  On a subsequent call, tff_data re-allocated to be shorter,
but ttf_size is not updated to match new ttf_data size.  This leads to buffer
over-read later.  In that processing, valid pointer is used, in combination
incorrect value indicating buffer size.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=2CCyUYPgBB&a=cc_unsubscribe

[Bug 1191083] CVE-2014-9661 freetype: out of bounds read in Type42 font parser

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

Martin Prpic <mprpic(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1197737



-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=WAKFuuNvEi&a=cc_unsubscribe

[Bug 1191083] CVE-2014-9661 freetype: out of bounds read in Type42 font parser

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

Martin Prpic <mprpic(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1197738



-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=MsmnaPxdVQ&a=cc_unsubscribe

[Bug 1191083] CVE-2014-9661 freetype: out of bounds read in Type42 font parser

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

Martin Prpic <mprpic(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1197739



-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=oVUdAM2JEZ&a=cc_unsubscribe

[Bug 1191083] CVE-2014-9661 freetype: out of bounds read in Type42 font parser

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

Martin Prpic <mprpic(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1197740



-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=UttgtfSxpU&a=cc_unsubscribe

[Bug 1191083] CVE-2014-9661 freetype: out of bounds read in Type42 font parser

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191083



--- Comment #7 from errata-xmlrpc <errata-xmlrpc(a)redhat.com&gt; ---
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2015:0696 https://rhn.redhat.com/errata/RHSA-2015-0696.html

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=5Kfi5mwryD&a=cc_unsubscribe

[Bug 1191083] CVE-2014-9661 freetype: out of bounds read in Type42 font parser

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

Tomas Hoger <thoger(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |ERRATA
        Last Closed|                            |2015-03-18 03:40:44



-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=eSpeSm0tCK&a=cc_unsubscribe

[Bug 1191083] CVE-2014-9661 freetype: out of bounds read in Type42 font parser

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

Vincent Danen <vdanen(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Whiteboard|impact=low,public=20141124, |impact=low,public=20141124,
                   |reported=20150210,source=cv |reported=20150210,source=cv
                   |e,cvss2=4.3/AV:N/AC:M/Au:N/ |e,cvss2=4.3/AV:N/AC:M/Au:N/
                   |C:N/I:N/A:P,cwe=CWE-125,rhe |C:N/I:N/A:P,cwe=CWE-125,rhe
                   |l-5/freetype=wontfix,rhel-6 |l-5/freetype=wontfix,rhel-6
                   |/freetype=affected,rhel-7/f |/freetype=notaffected,rhel-
                   |reetype=affected,rhev-m-3/m |7/freetype=affected,rhev-m-
                   |ingw-virt-viewer=affected,f |3/mingw-virt-viewer=affecte
                   |edora-all/freetype=affected |d,fedora-all/freetype=affec
                   |,fedora-all/mingw-freetype= |ted,fedora-all/mingw-freety
                   |affected,epel-7/mingw-freet |pe=affected,epel-7/mingw-fr
                   |ype=affected                |eetype=affected



-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=S7xXN2GagV&a=cc_unsubscribe

[Bug 1191083] CVE-2014-9661 freetype: out of bounds read in Type42 font parser

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1191083

Ján Rusnačko <jrusnack(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Whiteboard|impact=low,public=20141124, |impact=low,public=20141124,
                   |reported=20150210,source=cv |reported=20150210,source=cv
                   |e,cvss2=4.3/AV:N/AC:M/Au:N/ |e,cvss2=4.3/AV:N/AC:M/Au:N/
                   |C:N/I:N/A:P,cwe=CWE-125,rhe |C:N/I:N/A:P,cwe=CWE-125,rhe
                   |l-5/freetype=wontfix,rhel-6 |l-5/freetype=wontfix,rhel-6
                   |/freetype=notaffected,rhel- |/freetype=affected,rhel-7/f
                   |7/freetype=affected,rhev-m- |reetype=affected,rhev-m-3/m
                   |3/mingw-virt-viewer=affecte |ingw-virt-viewer=affected,f
                   |d,fedora-all/freetype=affec |edora-all/freetype=affected
                   |ted,fedora-all/mingw-freety |,fedora-all/mingw-freetype=
                   |pe=affected,epel-7/mingw-fr |affected,epel-7/mingw-freet
                   |eetype=affected             |ype=affected



-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=dC5hUoC87a&a=cc_unsubscribe