Several vulnerabilities have been discovered in the FreeType font library. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-1797     Multiple stack-based buffer overflows in the     cff_decoder_parse_charstrings function in the CFF Type2     CharStrings interpreter in cff/cffgload.c in FreeType     allow remote attackers to execute arbitrary code or     cause a denial of service (memory corruption) via     crafted CFF opcodes in embedded fonts in a PDF document,     as demonstrated by JailbreakMe.

  - CVE-2010-2541     Buffer overflow in ftmulti.c in the ftmulti demo program     in FreeType allows remote attackers to cause a denial of     service (application crash) or possibly execute     arbitrary code via a crafted font file.

  - CVE-2010-2805     The FT_Stream_EnterFrame function in base/ftstream.c in     FreeType does not properly validate certain position     values, which allows remote attackers to cause a denial     of service (application crash) or possibly execute     arbitrary code via a crafted font file

  - CVE-2010-2806     Array index error in the t42_parse_sfnts function in     type42/t42parse.c in FreeType allows remote attackers to     cause a denial of service (application crash) or     possibly execute arbitrary code via negative size values     for certain strings in FontType42 font files, leading to     a heap-based buffer overflow.

  - CVE-2010-2807     FreeType uses incorrect integer data types during bounds     checking, which allows remote attackers to cause a     denial of service (application crash) or possibly     execute arbitrary code via a crafted font file.

  - CVE-2010-2808     Buffer overflow in the Mac_Read_POST_Resource function     in base/ftobjs.c in FreeType allows remote attackers to     cause a denial of service (memory corruption and     application crash) or possibly execute arbitrary code     via a crafted Adobe Type 1 Mac Font File (aka LWFN)     font.

  - CVE-2010-3053     bdf/bdflib.c in FreeType allows remote attackers to     cause a denial of service (application crash) via a     crafted BDF font file, related to an attempted     modification of a value in a static string.

- Mon Oct 4 2010 Marek Kasik <mkasik at redhat.com>     2.3.11-6

    - Add freetype-2.3.11-CVE-2010-2805.patch (Fix       comparison.)

  - Add freetype-2.3.11-CVE-2010-2806.patch (Protect against     negative string_size. Fix comparison.)

  - Add freetype-2.3.11-CVE-2010-2808.patch (Check the total     length of collected POST segments.)

  - Add freetype-2.3.11-CVE-2010-3311.patch (Don't seek     behind end of stream.)

  - Resolves: #638522

    - Mon Oct 4 2010 Marek Kasik <mkasik at redhat.com>       2.3.11-5

    - Add freetype-2.3.11-CVE-2010-1797.patch (Check stack       after execution of operations too. Skip the       evaluations of the values in decoder, if       cff_decoder_parse_charstrings() returns any error.)

  - Resolves: #621627

    - Fri Oct 1 2010 Marek Kasik <mkasik at redhat.com>       2.3.11-4

    - Add freetype-2.3.11-CVE-2010-2498.patch (Assure that       `end_point' is not larger than `glyph->num_points')

  - Add freetype-2.3.11-CVE-2010-2499.patch (Check the     buffer size during gathering PFB fragments)

  - Add freetype-2.3.11-CVE-2010-2500.patch (Use smaller     threshold values for `width' and `height')

  - Add freetype-2.3.11-CVE-2010-2519.patch (Check `rlen'     the length of fragment declared in the POST fragment     header)

  - Add freetype-2.3.11-CVE-2010-2520.patch (Fix bounds     check)

  - Add freetype-2.3.11-CVE-2010-2527.patch (Use precision     for `%s' where appropriate to avoid buffer overflows)

  - Add freetype-2.3.11-CVE-2010-2541.patch (Avoid overflow     when dealing with names of axes)

  - Resolves: #613299

    - Thu Dec 3 2009 Behdad Esfahbod <behdad at redhat.com>       2.3.11-3

    - Add freetype-2.3.11-more-demos.patch

    - New demo programs ftmemchk, ftpatchk, and fttimer

    - Thu Dec 3 2009 Behdad Esfahbod <behdad at redhat.com>       2.3.11-2

    - Second try. Drop upstreamed patches.

    - Thu Dec 3 2009 Behdad Esfahbod <behdad at redhat.com>       2.3.11-1

    - 2.3.11

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated freetype packages that fix various security issues are now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently. The freetype packages for Red Hat Enterprise Linux 4 provide both the FreeType 1 and FreeType 2 font engines. The freetype packages for Red Hat Enterprise Linux 5 provide only the FreeType 2 font engine.

An invalid memory management flaw was found in the way the FreeType font engine processed font files. If a user loaded a carefully-crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-2498)

An integer overflow flaw was found in the way the FreeType font engine processed font files. If a user loaded a carefully-crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-2500)

Several buffer overflow flaws were found in the way the FreeType font engine processed font files. If a user loaded a carefully-crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-2499, CVE-2010-2519)

Several buffer overflow flaws were found in the FreeType demo applications. If a user loaded a carefully-crafted font file with a demo application, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-2527, CVE-2010-2541)

Red Hat would like to thank Robert Swiecki of the Google Security Team for the discovery of the CVE-2010-2498, CVE-2010-2500, CVE-2010-2499, CVE-2010-2519, and CVE-2010-2527 issues.

Note: All of the issues in this erratum only affect the FreeType 2 font engine.

Users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The X server must be restarted (log out, then log back in) for this update to take effect.

FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently. These packages provide both the FreeType 1 and FreeType 2 font engines.

An integer overflow flaw was found in the way the FreeType font engine processed font files. If a user loaded a carefully-crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-2500)

Several buffer overflow flaws were found in the FreeType demo applications. If a user loaded a carefully-crafted font file with a demo application, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-2527, CVE-2010-2541)

We would like to thank Robert Swiecki of the Google Security Team for the discovery of the CVE-2010-2500 and CVE-2010-2527 issues.

Note: All of the issues in this erratum only affect the FreeType 2 font engine.

Users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The X server must be restarted (log out, then log back in) for this update to take effect.

From Red Hat Security Advisory 2010:0577 :

Updated freetype packages that fix various security issues are now available for Red Hat Enterprise Linux 3.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently. These packages provide both the FreeType 1 and FreeType 2 font engines.

An integer overflow flaw was found in the way the FreeType font engine processed font files. If a user loaded a carefully-crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-2500)

Several buffer overflow flaws were found in the FreeType demo applications. If a user loaded a carefully-crafted font file with a demo application, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-2527, CVE-2010-2541)

Red Hat would like to thank Robert Swiecki of the Google Security Team for the discovery of the CVE-2010-2500 and CVE-2010-2527 issues.

Note: All of the issues in this erratum only affect the FreeType 2 font engine.

Users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The X server must be restarted (log out, then log back in) for this update to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0578 advisory.

    - Modify freetype-2.2.1-CVE-2010-2519.patch (additional fix)         (If the type of the POST fragment is 0, the segment is completely ignored)
    - Add freetype-2.2.1-CVE-2010-2527.patch         (Use precision for '%s' where appropriate to avoid buffer overflows)
    - Add freetype-2.2.1-CVE-2010-2498.patch         (Assure that 'end_point' is not larger than 'glyph->num_points')
    - Add freetype-2.2.1-CVE-2010-2499.patch         (Check the buffer size during gathering PFB fragments)
    - Add freetype-2.2.1-CVE-2010-2500.patch         (Use smaller threshold values for 'width' and 'height')
    - Add freetype-2.2.1-CVE-2010-2519.patch         (Check 'rlen' the length of fragment declared in the POST fragment header)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Mon Oct 4 2010 Marek Kasik <mkasik at redhat.com>     2.3.11-6

    - Add freetype-2.3.11-CVE-2010-2805.patch (Fix       comparison.)

  - Add freetype-2.3.11-CVE-2010-2806.patch (Protect against     negative string_size. Fix comparison.)

  - Add freetype-2.3.11-CVE-2010-2808.patch (Check the total     length of collected POST segments.)

  - Add freetype-2.3.11-CVE-2010-3311.patch (Don't seek     behind end of stream.)

  - Resolves: #638522

    - Mon Oct 4 2010 Marek Kasik <mkasik at redhat.com>       2.3.11-5

    - Add freetype-2.3.11-CVE-2010-1797.patch (Check stack       after execution of operations too. Skip the       evaluations of the values in decoder, if       cff_decoder_parse_charstrings() returns any error.)

  - Resolves: #621627

    - Fri Oct 1 2010 Marek Kasik <mkasik at redhat.com>       2.3.11-4

    - Add freetype-2.3.11-CVE-2010-2498.patch (Assure that       `end_point' is not larger than `glyph->num_points')

  - Add freetype-2.3.11-CVE-2010-2499.patch (Check the     buffer size during gathering PFB fragments)

  - Add freetype-2.3.11-CVE-2010-2500.patch (Use smaller     threshold values for `width' and `height')

  - Add freetype-2.3.11-CVE-2010-2519.patch (Check `rlen'     the length of fragment declared in the POST fragment     header)

  - Add freetype-2.3.11-CVE-2010-2520.patch (Fix bounds     check)

  - Add freetype-2.3.11-CVE-2010-2527.patch (Use precision     for `%s' where appropriate to avoid buffer overflows)

  - Add freetype-2.3.11-CVE-2010-2541.patch (Avoid overflow     when dealing with names of axes)

  - Resolves: #613299

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201201-09 (FreeType: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FreeType. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted font,       possibly resulting in the remote execution of arbitrary code with the       privileges of the user running the application, or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
49150	Debian DSA-2105-1 : freetype - several vulnerabilities	Nessus	Debian Local Security Checks	2010/9/9	2021/1/4	high
50437	Fedora 12 : freetype-2.3.11-6.fc12 (2010-15785)	Nessus	Fedora Local Security Checks	2010/11/2	2021/1/11	high
48212	RHEL 4 / 5 : freetype (RHSA-2010:0578)	Nessus	Red Hat Local Security Checks	2010/8/2	2021/1/14	medium
60826	Scientific Linux Security Update : freetype on SL3	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
68074	Oracle Linux 3 : freetype (ELSA-2010-0577)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
68075	Oracle Linux 5 : freetype (ELSA-2010-0578)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	high
50026	Fedora 13 : freetype-2.3.11-6.fc13 (2010-15705)	Nessus	Fedora Local Security Checks	2010/10/20	2021/1/11	high
57651	GLSA-201201-09 : FreeType: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2012/1/24	2021/1/6	high

检测

插件搜索

high

high

medium

medium

medium

high

high

high