https://bugzilla.redhat.com/show_bug.cgi?id=1191094 Vasyl Kaigorodov <vkaigoro(a)redhat.com&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1191102 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=iWhGYFBj30&a=cc_unsubscribe

https://bugzilla.redhat.com/show_bug.cgi?id=1191094 Tomas Hoger <thoger(a)redhat.com&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|medium |low Fixed In Version| |freetype 2.5.4 Summary|CVE-2014-9671 freetype: |CVE-2014-9671 freetype: |Off-by-one error in the |integer overflow in |pcf_get_properties function |pcf_get_encodings() leading |in pcf/pcfread.c |to NULL pointer dereference Whiteboard|impact=moderate,public=2014 |impact=low,public=20141124, |1124,reported=20150210,sour |reported=20150210,source=cv |ce=cve,cvss2=3.7/AV:L/AC:H/ |e,cvss2=4.3/AV:N/AC:M/Au:N/ |Au:N/C:P/I:P/A:P,fedora-all |C:N/I:N/A:P,cwe=CWE-190->CW |/freetype=affected,rhel-5/f |E-476,rhel-4/freetype=notaf |reetype=new,rhel-6/freetype |fected,rhel-5/freetype=wont |=new,rhel-7/freetype=new |fix,rhel-6/freetype=affecte | |d,rhel-7/freetype=affected, | |rhev-m-3/mingw-virt-viewer= | |affected,fedora-all/freetyp | |e=affected,fedora-all/mingw | |-freetype=affected,epel-7/m | |ingw-freetype=affected Severity|medium |low --- Comment #1 from Tomas Hoger <thoger(a)redhat.com&gt; --- Upstream bug is: https://savannah.nongnu.org/bugs/?43547 Issue was fixed upstream in 2.5.4. This is an integer overflow issue, rather than off-by-one. A string_size value is read from input font file. If value 0xffffffff is used and later 1 is added to it when FT_NEW_ARRAY() is called to allocate strings[] buffer, the addition will overflow (32bit overflow) and leads to attempt to allocate zero sized buffer. Freetype memory allocation functions return NULL in that case, which leads to crash when the buffer is populated later. Note that this issue was introduced by the CVE-2012-1130 fix (see bug 800587) in the following commit: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=c776fc17 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=u9Jm2RfmwU&a=cc_unsubscribe

https://bugzilla.redhat.com/show_bug.cgi?id=1191094 --- Comment #4 from Tomas Hoger <thoger(a)redhat.com&gt; --- The fix for this issue was found to introduce a regression that prevented loading of certain PCF fonts. Upstream bug and fix: https://savannah.nongnu.org/bugs/?43774 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=74af85... http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=06842c... Reported for Fedora in bug 1195652. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ENcqzRIXCm&a=cc_unsubscribe

https://bugzilla.redhat.com/show_bug.cgi?id=1191094 Martin Prpic <mprpic(a)redhat.com&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1197738 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=nbdEkfIRms&a=cc_unsubscribe

https://bugzilla.redhat.com/show_bug.cgi?id=1191094 Martin Prpic <mprpic(a)redhat.com&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1197740 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=pbNZAznPIb&a=cc_unsubscribe

https://bugzilla.redhat.com/show_bug.cgi?id=1191094 Tomas Hoger <thoger(a)redhat.com&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2015-03-18 03:40:54 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=9HFViiFDHk&a=cc_unsubscribe

https://bugzilla.redhat.com/show_bug.cgi?id=1191094 Ján Rusnačko <jrusnack(a)redhat.com&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20141124, |impact=low,public=20141124, |reported=20150210,source=cv |reported=20150210,source=cv |e,cvss2=4.3/AV:N/AC:M/Au:N/ |e,cvss2=4.3/AV:N/AC:M/Au:N/ |C:N/I:N/A:P,cwe=CWE-190->CW |C:N/I:N/A:P,cwe=CWE-190->CW |E-476,rhel-4/freetype=notaf |E-476,rhel-4/freetype=notaf |fected,rhel-5/freetype=wont |fected,rhel-5/freetype=wont |fix,rhel-6/freetype=notaffe |fix,rhel-6/freetype=affecte |cted,rhel-7/freetype=affect |d,rhel-7/freetype=affected, |ed,rhev-m-3/mingw-virt-view |rhev-m-3/mingw-virt-viewer= |er=affected,fedora-all/free |affected,fedora-all/freetyp |type=affected,fedora-all/mi |e=affected,fedora-all/mingw |ngw-freetype=affected,epel- |-freetype=affected,epel-7/m |7/mingw-freetype=affected |ingw-freetype=affected -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=0RpHx6PChl&a=cc_unsubscribe