https://bugzilla.redhat.com/show_bug.cgi?id=1191093 Vasyl Kaigorodov <vkaigoro(a)redhat.com&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1191099 Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1191099 [Bug 1191099] CVE-2014-9656 CVE-2014-9657 CVE-2014-9661 CVE-2014-9660 CVE-2014-9667 CVE-2014-9666 CVE-2014-9665 CVE-2014-9664 CVE-2014-9669 CVE-2014-9668 CVE-2014-9662 CVE-2014-9658 CVE-2014-9659 CVE-2014-9663 freetype: various flaws [fedora-all] -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=T1epB4rAMu&a=cc_unsubscribe

https://bugzilla.redhat.com/show_bug.cgi?id=1191093 Vasyl Kaigorodov <vkaigoro(a)redhat.com&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1191102 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=61Mkes8fPP&a=cc_unsubscribe

https://bugzilla.redhat.com/show_bug.cgi?id=1191093 --- Comment #2 from Fedora Update System <updates(a)fedoraproject.org&gt; --- freetype-2.5.3-15.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Dl6GufzRNz&a=cc_unsubscribe

https://bugzilla.redhat.com/show_bug.cgi?id=1191093 Tomas Hoger <thoger(a)redhat.com&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|medium |low Fixed In Version| |freetype 2.5.4 Summary|CVE-2014-9670 freetype: |CVE-2014-9670 freetype: |Multiple integer signedness |integer overflow in |errors in the |pcf_get_encodings() leading |pcf_get_encodings function |to NULL pointer dereference |inpcf/pcfread.c | Whiteboard|impact=moderate,public=2014 |impact=low,public=20141124, |1124,reported=20150210,sour |reported=20150210,source=cv |ce=cve,cvss2=3.7/AV:L/AC:H/ |e,cvss2=4.3/AV:N/AC:M/Au:N/ |Au:N/C:P/I:P/A:P,fedora-all |C:N/I:N/A:P,cwe=CWE-190->CW |/freetype=affected,rhel-5/f |E-476,rhel-4/freetype=wontf |reetype=new,rhel-6/freetype |ix,rhel-5/freetype=wontfix, |=new,rhel-7/freetype=new |rhel-6/freetype=affected,rh | |el-7/freetype=affected,rhev | |-m-3/mingw-virt-viewer=affe | |cted,fedora-all/freetype=af | |fected,fedora-all/mingw-fre | |etype=affected,epel-7/mingw | |-freetype=affected Severity|medium |low --- Comment #4 from Tomas Hoger <thoger(a)redhat.com&gt; --- Upstream bug is: https://savannah.nongnu.org/bugs/?43548 Issue was fixed upstream in 2.5.4. Affected code reads 4 short values from the input file. There are 2 "pairs", for which difference is computed and 1 added to the difference (basically: last - first + 1). Results are multiplied together to produce the number of encodings. Resulting value is in the range of 32bit signed integer (-2^31 to 2^31-1). Negative values cause freetype memory allocation function to return error, which causes pcf_get_encodings() to exit early. The value of 0 causes memory allocation function to return NULL, which is later dereferenced, leading to crash. Positive values are ok. As value of each operand of the multiplication can not exceed 65536 (i.e. 2^16), result can not exceed 2^32. Therefore, this can not lead to allocation of a too small buffer that is later overflown. Hence there is no memory corruption / code execution impact. Note that the integer signedness issue mentioned in the upstream report does not seem relevant. The same would be possible if first* and last* variables were unsigned. Also noted that the NULL pointer dereference occurs in the code introduced by this commit: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0eb6316f which was added in upstream version 2.4.12. It does not seem to be possible to trigger NULL pointer dereference in earlier versions, hence this does not seem to have any practical impact on the freetype packages in Red Hat Enterprise Linux 7 and earlier. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=bchv8X8hTu&a=cc_unsubscribe

https://bugzilla.redhat.com/show_bug.cgi?id=1191093 Martin Prpic <mprpic(a)redhat.com&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1197738 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=WncbrD2cvJ&a=cc_unsubscribe

https://bugzilla.redhat.com/show_bug.cgi?id=1191093 Martin Prpic <mprpic(a)redhat.com&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1197740 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=cahCiXSX1B&a=cc_unsubscribe

https://bugzilla.redhat.com/show_bug.cgi?id=1191093 Tomas Hoger <thoger(a)redhat.com&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2015-03-18 03:40:49 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=C33rma2s2H&a=cc_unsubscribe

https://bugzilla.redhat.com/show_bug.cgi?id=1191093 Ján Rusnačko <jrusnack(a)redhat.com&gt; changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20141124, |impact=low,public=20141124, |reported=20150210,source=cv |reported=20150210,source=cv |e,cvss2=4.3/AV:N/AC:M/Au:N/ |e,cvss2=4.3/AV:N/AC:M/Au:N/ |C:N/I:N/A:P,cwe=CWE-190->CW |C:N/I:N/A:P,cwe=CWE-190->CW |E-476,rhel-4/freetype=wontf |E-476,rhel-4/freetype=wontf |ix,rhel-5/freetype=wontfix, |ix,rhel-5/freetype=wontfix, |rhel-6/freetype=notaffected |rhel-6/freetype=affected,rh |,rhel-7/freetype=affected,r |el-7/freetype=affected,rhev |hev-m-3/mingw-virt-viewer=a |-m-3/mingw-virt-viewer=affe |ffected,fedora-all/freetype |cted,fedora-all/freetype=af |=affected,fedora-all/mingw- |fected,fedora-all/mingw-fre |freetype=affected,epel-7/mi |etype=affected,epel-7/mingw |ngw-freetype=affected |-freetype=affected -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=vJxqk4Mj5A&a=cc_unsubscribe