FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to BDF fonts and the improper handling of an "allocation error" in the bdf_free_font function.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - freetype: Use of uninitialized memory (CVE-2014-9746)

  - FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (NULL pointer     dereference and crash) via vectors related to BDF fonts and the improper handling of an allocation error     in the bdf_free_font function. (CVE-2012-5668)

  - The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a     denial of service (infinite loop) via a broken number-with-base in a Postscript stream, as demonstrated     by 8#garbage. (CVE-2014-9745)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Solaris system is missing necessary patches to address security updates :

  - FreeType before 2.4.11 allows context-dependent     attackers to cause a denial of service (NULL pointer     dereference and crash) via vectors related to BDF fonts     and the improper handling of an 'allocation error' in     the bdf_free_font function. (CVE-2012-5668)

  - The _bdf_parse_glyphs function in FreeType before 2.4.11     allows context-dependent attackers to cause a denial of     service (crash) and possibly execute arbitrary code via     vectors related to BDF fonts and an incorrect     calculation that triggers an out-of-bounds read.
    (CVE-2012-5669)

  - The _bdf_parse_glyphs function in FreeType before 2.4.11     allows context-dependent attackers to cause a denial of     service (out-of-bounds write and crash) via vectors     related to BDF fonts and an ENCODING field with a     negative value. (CVE-2012-5670)

- BNC#795826, CVE-2012-5668.patch [bdf] Fix Savannah bug     #37905.

  - src/bdf/bdflib.c (_bdf_parse_start): Reset `props_size'     to zero in case of allocation error; this value gets     used in a loop in

  - BNC#795826, CVE-2012-5669.patch [bdf] Fix Savannah bug     #37906.

  - src/bdf/bdflib.c (_bdf_parse_glyphs): Use correct array     size for checking `glyph_enc'.

  - BNC#795826, CVE-2012-5670.patch [bdf] Fix Savannah bug     #37907.

  - src/bdf/bdflib.c (_bdf_parse_glyphs) <ENCODING>:
    Normalize negative second parameter of `ENCODING' field     also.

- new license string.

  - BNC#795826, CVE-2012-5668.patch

  - BNC#795826, CVE-2012-5669.patch [bdf] Fix Savannah bug     #37906.

  - src/bdf/bdflib.c (_bdf_parse_glyphs): Use correct array     size for checking `glyph_enc'.

The remote host is affected by the vulnerability described in GLSA-201402-16 (FreeType: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FreeType. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted font, possibly resulting in execution of arbitrary code with the       privileges of the user running the application, or a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

Updated freetype2 packages fixes security vulnerabilities :

A NULL pointer de-reference flaw was found in the way Freetype font rendering engine handled Glyph bitmap distribution format (BDF) fonts.
A remote attacker could provide a specially crafted BDF font file, which once processed in an application linked against FreeType would lead to that application crash (CVE-2012-5668).

An out-of heap-based buffer read flaw was found in the way FreeType font rendering engine performed parsing of glyph information and relevant bitmaps for glyph bitmap distribution format (BDF). A remote attacker could provide a specially crafted BDF font file, which once opened in an application linked against FreeType would lead to that application crash (CVE-2012-5669).

An out-of heap-based buffer write flaw was found in the way FreeType font rendering engine performed parsing of glyph information and relevant bitmaps for glyph bitmap distribution format (BDF). A remote attacker could provide a specially crafted font file, which once opened in an application linked against FreeType would lead to that application crash, or, potentially, arbitrary code execution with the privileges of the user running the application (CVE-2012-5670).

Multiple vulnerabilities has been found and corrected in freetype2 :

A NULL pointer de-reference flaw was found in the way Freetype font rendering engine handled Glyph bitmap distribution format (BDF) fonts.
A remote attacker could provide a specially crafted BDF font file, which once processed in an application linked against FreeType would lead to that application crash (CVE-2012-5668).

An out-of heap-based buffer read flaw was found in the way FreeType font rendering engine performed parsing of glyph information and relevant bitmaps for glyph bitmap distribution format (BDF). A remote attacker could provide a specially crafted BDF font file, which once opened in an application linked against FreeType would lead to that application crash (CVE-2012-5669).

The updated packages have been patched to correct these issues.

This update fixes :

  - OOB access in bdf_free_font() and _bdf_parse_glyphs()     (CVE-2012-5668 / CVE-2012-5669) As well as the following     non-security bugs :

  - [bdf] Savannah bug #37905.

  - src/bdf/bdflib.c (_bdf_parse_start): Reset `props_size'     to zero in case of allocation error; this value gets     used in a loop in

  - [bdf] Fix Savannah bug #37906.

  - src/bdf/bdflib.c (_bdf_parse_glyphs): Use correct array     size for checking `glyph_enc'.

This update fixes :

  - OOB access in bdf_free_font() (CVE-2012-5668) As well as     non-security bugs :

  - [bdf] Savannah bug #37905. o src/bdf/bdflib.c     (_bdf_parse_start): Reset `props_size' to zero in case     of allocation error; this value gets used in a loop in

New freetype packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix security issues.

Mateusz Jurczyk discovered that FreeType did not correctly handle certain malformed BDF font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash or possibly execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198605	RHEL 6 : freetype (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
80614	Oracle Solaris Third-Party Patch Update : freetype (multiple_buffer_errors_vulnerabilities_in)	Nessus	Solaris Local Security Checks	medium
75015	openSUSE Security Update : freetype2 (openSUSE-SU-2013:0165-1)	Nessus	SuSE Local Security Checks	medium
75003	openSUSE Security Update : freetype2 (openSUSE-SU-2013:0177-1)	Nessus	SuSE Local Security Checks	medium
72453	GLSA-201402-16 : FreeType: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
66053	Mandriva Linux Security Advisory : freetype2 (MDVSA-2013:039)	Nessus	Mandriva Local Security Checks	medium
64504	Mandriva Linux Security Advisory : freetype2 (MDVSA-2013:006)	Nessus	Mandriva Local Security Checks	medium
64144	SuSE 11.2 Security Update : freetype2 (SAT Patch Number 7232)	Nessus	SuSE Local Security Checks	medium
64092	SuSE 10 Security Update : freetype2 (ZYPP Patch Number 8433)	Nessus	SuSE Local Security Checks	medium
63555	Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : freetype (SSA:2013-015-01)	Nessus	Slackware Local Security Checks	medium
63536	Ubuntu 8.04 LTS / 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : freetype vulnerabilities (USN-1686-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2012-5668

high

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium