Date: Thu, 2 Dec 2010 15:55:09 -0500 (EST) From: Josh Bressers <bressers@...hat.com> To: oss-security@...ts.openwall.com Cc: Ulrik Persson <ddefrostt@...il.com>, "Steven M. Christey" <coley@...us.mitre.org> Subject: Re: CVE Request -- FontForge: Stack-based buffer overflow by processing specially-crafted CHARSET_REGISTRY font file header Please use CVE-2010-4259 for this. Thanks. -- JB ----- "Jan Lieskovsky" <jlieskov@...hat.com> wrote: > Hello Steve, vendors, > > Ulrik Persson reported a stack-based buffer overflow > flaw in the way FontForge font editor processed certain > Bitmap Distribution Format (BDF) font files, with > specially-crafted value of the CHARSET_REGISTRY header. > A remote attacker could create a specially-crafted BDF > font file and trick a local, unsuspecting user into > opening it in FontForge, which could lead to fontforge > executable crash or, potentially, arbitrary code execution > with the privileges of the user running the executable. > > References: >  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=605537 >  https://bugzilla.redhat.com/show_bug.cgi?id=659359 > > Public PoC: >  > http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=fontforge-overflow.txt;att=1;bug=605537 > > Flaw severity note: > On systems with compile time buffer checks (FORTIFY_SOURCE) > feature enabled, the impact of this flaw is mitigated to > be only crash. > > Could you allocate a CVE id for this issue? > > Thanks && Regards, Jan. > -- > Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.