oss-security - Re: CVE Request -- FreeType -- Memory corruption flaw by processing certain LWFN fonts + three more

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 9 Aug 2010 08:37:01 -0700
From: Braden Thomas <bthomas@...le.com>
To: Josh Bressers <bressers@...hat.com>
Cc: Werner Lemberg <wl@....org>,
 oss-security@...ts.openwall.com
Subject: Re: CVE Request -- FreeType -- Memory corruption flaw by processing certain LWFN fonts + three more

So these issues are going to be addressed in upcoming 2.4.3, right?  They still affect 2.4.2?

Thanks,

Braden

On Aug 6, 2010, at 11:32 AM, Josh Bressers wrote:

> 
> ----- "Jan Lieskovsky" <jlieskov@...hat.com> wrote:
> 
>> 
>>   just for more complete list. There are more of them:
>>     [1] https://savannah.nongnu.org/bugs/?30644
>>         Patch at: 
>> http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=45a3c76b547511fa9d97aca34b150a0663257375
> 
> I'm going to call this improper bounds checking.
> Use CVE-2010-2805
> 
> 
>>     [2] https://savannah.nongnu.org/bugs/?30656
>>         Patch at:
>> http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=c06da1ad34663da7b6fc39b030dc3ae185b96557
> 
> We'll also call this improper bounds checking. I'm giving it its own ID, as
> the various versions affected will no doubt differ.
> Use CVE-2010-2806
> 
>>     [3] https://savannah.nongnu.org/bugs/?30657
>>         Patch at:
>> http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=346f1867fd32dae8f56e5b482d1af98f626804ac
> 
> I'm not exactly sure what to call this one. It seems to involve improper
> type comparisons (int vs long).
> Use CVE-2010-2807
> 
>>>  A memory corruption flaw was found in the way FreeType font rendering
>>>  engine processed certain Adobe Type 1 Mac Font File (LWFN) fonts. An
>>>  attacker could use this flaw to create a specially-crafted font file
>>>  that, when opened, would cause an application linked against
>>>  libfreetype to crash, or, possibly execute arbitrary code.
>>> 
>>> Upstream bug report:
>>>  [1] https://savannah.nongnu.org/bugs/?30658
>>> 
>>> Public reproducer:
>>>  [2] http://alt.swiecki.net/j/f/sigsegv31.ttf
>>> 
>>> Upstream changeset:
>>>  [3] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=81f3472c0ba7b8f6466e2e214fa8c1c17fade975
>>> 
>>> References:
>>>  [4] https://bugzilla.redhat.com/show_bug.cgi?id=621907
>>> 
>>> Credit: Robert Swiecki
> 
> Use CVE-2010-2808 for this one.
> 
> Thanks.
> 
> -- 
>    JB


Download attachment "smime.p7s" of type "application/pkcs7-signature" (3833 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.