The FT_Stream_EnterFrame function in base/ftstream.c in FreeType before 2.4.2 does not properly validate certain position values, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.

This update of freetype2 fixes several vulnerabilities that could lead to remote system compromise by executing arbitrary code with user privileges :

  - CVE-2010-1797: stack-based buffer overflow while     processing CFF opcodes

  - CVE-2010-2497: integer underflow

  - CVE-2010-2498: invalid free

  - CVE-2010-2499: buffer overflow

  - CVE-2010-2500: integer overflow

  - CVE-2010-2519: heap buffer overflow

  - CVE-2010-2520: heap buffer overflow

  - CVE-2010-2527: buffer overflows in the freetype demo

  - CVE-2010-2541: buffer overflow in ftmulti demo program

  - CVE-2010-2805: improper bounds checking

  - CVE-2010-2806: improper bounds checking

  - CVE-2010-2807: improper type comparisons

  - CVE-2010-2808: memory corruption flaw by processing     certain LWFN fonts

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0889 advisory.

    - Add freetype-2.3.11-CVE-2010-3855.patch         (Protect against invalid runcnt values.)
    - Add freetype-2.3.11-CVE-2010-2805.patch         (Fix comparison.)
    - Add freetype-2.3.11-CVE-2010-2806.patch         (Protect against negative string_size. Fix comparison.)
    - Add freetype-2.3.11-CVE-2010-2808.patch         (Check the total length of collected POST segments.)
    - Add freetype-2.3.11-CVE-2010-3311.patch         (Dont seek behind end of stream.)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was found that the FreeType font rendering engine improperly validated certain position values when processing input streams. If a user loaded a specially crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-2805, CVE-2010-3311)

A stack-based buffer overflow flaw was found in the way the FreeType font rendering engine processed some PostScript Type 1 fonts. If a user loaded a specially crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-2808)

An array index error was found in the way the FreeType font rendering engine processed certain PostScript Type 42 font files. If a user loaded a specially crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-2806)

Note: All of the issues in this erratum only affect the FreeType 2 font engine.

The X server must be restarted (log out, then log back in) for this update to take effect.

The remote host is affected by the vulnerability described in GLSA-201201-09 (FreeType: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FreeType. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted font,       possibly resulting in the remote execution of arbitrary code with the       privileges of the user running the application, or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

This update of freetype2 fixes several vulnerabilities that could lead to remote system compromise by executing arbitrary code with user privileges :

  - stack-based buffer overflow while processing CFF     opcodes. (CVE-2010-1797)

  - integer underflow. (CVE-2010-2497)

  - invalid free. (CVE-2010-2498)

  - buffer overflow. (CVE-2010-2499)

  - integer overflow. (CVE-2010-2500)

  - heap buffer overflow. (CVE-2010-2519)

  - heap buffer overflow. (CVE-2010-2520)

  - buffer overflows in the freetype demo. (CVE-2010-2527)

  - buffer overflow in ftmulti demo program. (CVE-2010-2541)

  - improper bounds checking. (CVE-2010-2805)

  - improper bounds checking. (CVE-2010-2806)

  - improper type comparisons. (CVE-2010-2807)

  - memory corruption flaw by processing certain LWFN fonts.
    (CVE-2010-2808)

The remote mobile host is a using a version of Apple iOS earlier than 4.2. Such versions are potentially affected by multiple vulnerabilities. Apple iOS 4.2 contains security fixes for the following components :

  - Configuration Policies

  - CoreGraphics

  - FreeType

  - iAd Content Display

  - ImageIO

  - libxml

  - Mail

  - Networking

  - OfficeImport

  - Photos

  - Safari

  - Telephony

  - WebKit

  - Multiple components

Updated freetype packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently. These packages provide the FreeType 2 font engine.

It was found that the FreeType font rendering engine improperly validated certain position values when processing input streams. If a user loaded a specially crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-2805, CVE-2010-3311)

A stack-based buffer overflow flaw was found in the way the FreeType font rendering engine processed some PostScript Type 1 fonts. If a user loaded a specially crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-2808)

An array index error was found in the way the FreeType font rendering engine processed certain PostScript Type 42 font files. If a user loaded a specially crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-2806)

Note: All of the issues in this erratum only affect the FreeType 2 font engine.

Users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The X server must be restarted (log out, then log back in) for this update to take effect.

Versions of Mac OS X 10.6 earlier than 10.6.5 are potentially affected by multiple vulnerabilities.  Mac OS X 10.6.5 contains security fixes for the following products :

  - AFP Server

  - Apache mod_perl

  - Apache

  - AppKit

  - ATS

  - CFNetwork

  - CoreGraphics

  - CoreText

  - CUPS

  - Directory Services

  - diskdev_cmds

Disk Images

  - Flash Player plug-in

  - gzip

  - Image Capture

  - ImageIO

  - Image RAW

  - Kernel

  - MySQL

  - neon

  - Networking

  - OpenLDAP

  - OpenSSL

  - Password Server

  - PHP

  - Printing

  - python

  - QuickLook

  - QuickTime

  - Safari RSS

  - Time Machine

  - Wiki Server

  - X11

  - xar

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-007 applied. 

This security update contains fixes for the following products :

  - AFP Server
  - Apache mod_perl
  - ATS
  - CFNetwork
  - CoreGraphics
  - CoreText
  - CUPS
  - Directory Services
  - diskdev_cmds
  - Disk Images
  - Flash Player plug-in
  - gzip
  - ImageIO
  - Image RAW
  - MySQL
  - Password Server
  - PHP
  - Printing
  - python
  - QuickLook
  - Safari RSS
  - Wiki Server
  - X11

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.5.

Mac OS X 10.6.5 contains security fixes for the following products :

  - AFP Server
  - Apache mod_perl
  - Apache
  - AppKit
  - ATS
  - CFNetwork
  - CoreGraphics
  - CoreText
  - CUPS
  - Directory Services
  - diskdev_cmds
  - Disk Images
  - Flash Player plug-in
  - gzip
  - Image Capture
  - ImageIO
  - Image RAW
  - Kernel
  - MySQL
  - neon
  - Networking
  - OpenLDAP
  - OpenSSL
  - Password Server
  - PHP
  - Printing
  - python
  - QuickLook
  - QuickTime
  - Safari RSS
  - Time Machine
  - Wiki Server
  - X11
  - xar

- Mon Oct 4 2010 Marek Kasik <mkasik at redhat.com>     2.3.11-6

    - Add freetype-2.3.11-CVE-2010-2805.patch (Fix       comparison.)

  - Add freetype-2.3.11-CVE-2010-2806.patch (Protect against     negative string_size. Fix comparison.)

  - Add freetype-2.3.11-CVE-2010-2808.patch (Check the total     length of collected POST segments.)

  - Add freetype-2.3.11-CVE-2010-3311.patch (Don't seek     behind end of stream.)

  - Resolves: #638522

    - Mon Oct 4 2010 Marek Kasik <mkasik at redhat.com>       2.3.11-5

    - Add freetype-2.3.11-CVE-2010-1797.patch (Check stack       after execution of operations too. Skip the       evaluations of the values in decoder, if       cff_decoder_parse_charstrings() returns any error.)

  - Resolves: #621627

    - Fri Oct 1 2010 Marek Kasik <mkasik at redhat.com>       2.3.11-4

    - Add freetype-2.3.11-CVE-2010-2498.patch (Assure that       `end_point' is not larger than `glyph->num_points')

  - Add freetype-2.3.11-CVE-2010-2499.patch (Check the     buffer size during gathering PFB fragments)

  - Add freetype-2.3.11-CVE-2010-2500.patch (Use smaller     threshold values for `width' and `height')

  - Add freetype-2.3.11-CVE-2010-2519.patch (Check `rlen'     the length of fragment declared in the POST fragment     header)

  - Add freetype-2.3.11-CVE-2010-2520.patch (Fix bounds     check)

  - Add freetype-2.3.11-CVE-2010-2527.patch (Use precision     for `%s' where appropriate to avoid buffer overflows)

  - Add freetype-2.3.11-CVE-2010-2541.patch (Avoid overflow     when dealing with names of axes)

  - Resolves: #613299

    - Thu Dec 3 2009 Behdad Esfahbod <behdad at redhat.com>       2.3.11-3

    - Add freetype-2.3.11-more-demos.patch

    - New demo programs ftmemchk, ftpatchk, and fttimer

    - Thu Dec 3 2009 Behdad Esfahbod <behdad at redhat.com>       2.3.11-2

    - Second try. Drop upstreamed patches.

    - Thu Dec 3 2009 Behdad Esfahbod <behdad at redhat.com>       2.3.11-1

    - 2.3.11

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Mon Oct 4 2010 Marek Kasik <mkasik at redhat.com>     2.3.11-6

    - Add freetype-2.3.11-CVE-2010-2805.patch (Fix       comparison.)

  - Add freetype-2.3.11-CVE-2010-2806.patch (Protect against     negative string_size. Fix comparison.)

  - Add freetype-2.3.11-CVE-2010-2808.patch (Check the total     length of collected POST segments.)

  - Add freetype-2.3.11-CVE-2010-3311.patch (Don't seek     behind end of stream.)

  - Resolves: #638522

    - Mon Oct 4 2010 Marek Kasik <mkasik at redhat.com>       2.3.11-5

    - Add freetype-2.3.11-CVE-2010-1797.patch (Check stack       after execution of operations too. Skip the       evaluations of the values in decoder, if       cff_decoder_parse_charstrings() returns any error.)

  - Resolves: #621627

    - Fri Oct 1 2010 Marek Kasik <mkasik at redhat.com>       2.3.11-4

    - Add freetype-2.3.11-CVE-2010-2498.patch (Assure that       `end_point' is not larger than `glyph->num_points')

  - Add freetype-2.3.11-CVE-2010-2499.patch (Check the     buffer size during gathering PFB fragments)

  - Add freetype-2.3.11-CVE-2010-2500.patch (Use smaller     threshold values for `width' and `height')

  - Add freetype-2.3.11-CVE-2010-2519.patch (Check `rlen'     the length of fragment declared in the POST fragment     header)

  - Add freetype-2.3.11-CVE-2010-2520.patch (Fix bounds     check)

  - Add freetype-2.3.11-CVE-2010-2527.patch (Use precision     for `%s' where appropriate to avoid buffer overflows)

  - Add freetype-2.3.11-CVE-2010-2541.patch (Avoid overflow     when dealing with names of axes)

  - Resolves: #613299

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the FreeType font library. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-1797     Multiple stack-based buffer overflows in the     cff_decoder_parse_charstrings function in the CFF Type2     CharStrings interpreter in cff/cffgload.c in FreeType     allow remote attackers to execute arbitrary code or     cause a denial of service (memory corruption) via     crafted CFF opcodes in embedded fonts in a PDF document,     as demonstrated by JailbreakMe.

  - CVE-2010-2541     Buffer overflow in ftmulti.c in the ftmulti demo program     in FreeType allows remote attackers to cause a denial of     service (application crash) or possibly execute     arbitrary code via a crafted font file.

  - CVE-2010-2805     The FT_Stream_EnterFrame function in base/ftstream.c in     FreeType does not properly validate certain position     values, which allows remote attackers to cause a denial     of service (application crash) or possibly execute     arbitrary code via a crafted font file

  - CVE-2010-2806     Array index error in the t42_parse_sfnts function in     type42/t42parse.c in FreeType allows remote attackers to     cause a denial of service (application crash) or     possibly execute arbitrary code via negative size values     for certain strings in FontType42 font files, leading to     a heap-based buffer overflow.

  - CVE-2010-2807     FreeType uses incorrect integer data types during bounds     checking, which allows remote attackers to cause a     denial of service (application crash) or possibly     execute arbitrary code via a crafted font file.

  - CVE-2010-2808     Buffer overflow in the Mac_Read_POST_Resource function     in base/ftobjs.c in FreeType allows remote attackers to     cause a denial of service (memory corruption and     application crash) or possibly execute arbitrary code     via a crafted Adobe Type 1 Mac Font File (aka LWFN)     font.

  - CVE-2010-3053     bdf/bdflib.c in FreeType allows remote attackers to     cause a denial of service (application crash) via a     crafted BDF font file, related to an attempted     modification of a value in a static string.

Multiple vulnerabilities has been found and corrected in freetype2 :

The FT_Stream_EnterFrame function in base/ftstream.c in FreeType before 2.4.2 does not properly validate certain position values, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file (CVE-2010-2805).

Array index error in the t42_parse_sfnts function in type42/t42parse.c in FreeType before 2.4.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via negative size values for certain strings in FontType42 font files, leading to a heap-based buffer overflow (CVE-2010-2806).

FreeType before 2.4.2 uses incorrect integer data types during bounds checking, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file (CVE-2010-2807).

Buffer overflow in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.4.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Adobe Type 1 Mac Font File (aka LWFN) font (CVE-2010-2808).

bdf/bdflib.c in FreeType before 2.4.2 allows remote attackers to cause a denial of service (application crash) via a crafted BDF font file, related to an attempted modification of a value in a static string (CVE-2010-3053).

The updated packages have been patched to correct these issues.

Multiple vulnerabilities has been found and corrected in freetype2 :

The FT_Stream_EnterFrame function in base/ftstream.c in FreeType before 2.4.2 does not properly validate certain position values, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file (CVE-2010-2805).

Array index error in the t42_parse_sfnts function in type42/t42parse.c in FreeType before 2.4.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via negative size values for certain strings in FontType42 font files, leading to a heap-based buffer overflow (CVE-2010-2806).

FreeType before 2.4.2 uses incorrect integer data types during bounds checking, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file (CVE-2010-2807).

Buffer overflow in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.4.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Adobe Type 1 Mac Font File (aka LWFN) font (CVE-2010-2808).

bdf/bdflib.c in FreeType before 2.4.2 allows remote attackers to cause a denial of service (application crash) via a crafted BDF font file, related to an attempted modification of a value in a static string (CVE-2010-3053).

Unspecified vulnerability in FreeType 2.3.9, and other versions before 2.4.2, allows remote attackers to cause a denial of service via vectors involving nested Standard Encoding Accented Character (aka seac) calls, related to psaux.h, cffgload.c, cffgload.h, and t1decode.c (CVE-2010-3054).

Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct these issues.

It was discovered that FreeType did not correctly handle certain malformed font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash or possibly execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75578	openSUSE Security Update : libfreetype6 (openSUSE-SU-2010:0549-1)	Nessus	SuSE Local Security Checks	high
68142	Oracle Linux 5 / 6 : freetype (ELSA-2010-0889)	Nessus	Oracle Linux Local Security Checks	high
60890	Scientific Linux Security Update : freetype on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
57651	GLSA-201201-09 : FreeType: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
50905	SuSE 11 / 11.1 Security Update : freetype2 (SAT Patch Numbers 2914 / 2919)	Nessus	SuSE Local Security Checks	high
5715	Apple iOS < 4.2 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	critical
50636	RHEL 6 : freetype (RHSA-2010:0864)	Nessus	Red Hat Local Security Checks	high
5705	Mac OS X 10.6 < 10.6.5 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
50549	Mac OS X Multiple Vulnerabilities (Security Update 2010-007)	Nessus	MacOS X Local Security Checks	critical
50548	Mac OS X 10.6.x < 10.6.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
50437	Fedora 12 : freetype-2.3.11-6.fc12 (2010-15785)	Nessus	Fedora Local Security Checks	high
50026	Fedora 13 : freetype-2.3.11-6.fc13 (2010-15705)	Nessus	Fedora Local Security Checks	high
49854	SuSE 10 Security Update : freetype2 (ZYPP Patch Number 7121)	Nessus	SuSE Local Security Checks	high
49150	Debian DSA-2105-1 : freetype - several vulnerabilities	Nessus	Debian Local Security Checks	high
48900	SuSE9 Security Update : freetype2 (YOU Patch Number 12630)	Nessus	SuSE Local Security Checks	high
48755	openSUSE Security Update : freetype2 (openSUSE-SU-2010:0549-1)	Nessus	SuSE Local Security Checks	high
48753	openSUSE Security Update : freetype2 (openSUSE-SU-2010:0549-1)	Nessus	SuSE Local Security Checks	high
48403	Mandriva Linux Security Advisory : freetype2 (MDVSA-2010:157)	Nessus	Mandriva Local Security Checks	medium
48402	Mandriva Linux Security Advisory : freetype2 (MDVSA-2010:156)	Nessus	Mandriva Local Security Checks	medium
48361	Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : freetype vulnerabilities (USN-972-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2010-2805

high

Tenable Plugins

high

high

high

high

high

critical

high

critical

critical

critical

high

high

high

high

high

high

high

medium

medium

high