Date: Thu, 02 Dec 2010 17:21:29 +0100 From: Jan Lieskovsky <jlieskov@...hat.com> To: "Steven M. Christey" <coley@...us.mitre.org> CC: oss-security <oss-security@...ts.openwall.com>, Ulrik Persson <ddefrostt@...il.com> Subject: CVE Request -- FontForge: Stack-based buffer overflow by processing specially-crafted CHARSET_REGISTRY font file header Hello Steve, vendors, Ulrik Persson reported a stack-based buffer overflow flaw in the way FontForge font editor processed certain Bitmap Distribution Format (BDF) font files, with specially-crafted value of the CHARSET_REGISTRY header. A remote attacker could create a specially-crafted BDF font file and trick a local, unsuspecting user into opening it in FontForge, which could lead to fontforge executable crash or, potentially, arbitrary code execution with the privileges of the user running the executable. References:  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=605537  https://bugzilla.redhat.com/show_bug.cgi?id=659359 Public PoC:  http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=fontforge-overflow.txt;att=1;bug=605537 Flaw severity note: On systems with compile time buffer checks (FORTIFY_SOURCE) feature enabled, the impact of this flaw is mitigated to be only crash. Could you allocate a CVE id for this issue? Thanks && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.