The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) via vectors related to BDF fonts and an ENCODING field with a negative value.

The remote Solaris system is missing necessary patches to address security updates :

  - FreeType before 2.4.11 allows context-dependent     attackers to cause a denial of service (NULL pointer     dereference and crash) via vectors related to BDF fonts     and the improper handling of an 'allocation error' in     the bdf_free_font function. (CVE-2012-5668)

  - The _bdf_parse_glyphs function in FreeType before 2.4.11     allows context-dependent attackers to cause a denial of     service (crash) and possibly execute arbitrary code via     vectors related to BDF fonts and an incorrect     calculation that triggers an out-of-bounds read.
    (CVE-2012-5669)

  - The _bdf_parse_glyphs function in FreeType before 2.4.11     allows context-dependent attackers to cause a denial of     service (out-of-bounds write and crash) via vectors     related to BDF fonts and an ENCODING field with a     negative value. (CVE-2012-5670)

- BNC#795826, CVE-2012-5668.patch [bdf] Fix Savannah bug     #37905.

  - src/bdf/bdflib.c (_bdf_parse_start): Reset `props_size'     to zero in case of allocation error; this value gets     used in a loop in

  - BNC#795826, CVE-2012-5669.patch [bdf] Fix Savannah bug     #37906.

  - src/bdf/bdflib.c (_bdf_parse_glyphs): Use correct array     size for checking `glyph_enc'.

  - BNC#795826, CVE-2012-5670.patch [bdf] Fix Savannah bug     #37907.

  - src/bdf/bdflib.c (_bdf_parse_glyphs) <ENCODING>:
    Normalize negative second parameter of `ENCODING' field     also.

The remote host is affected by the vulnerability described in GLSA-201402-16 (FreeType: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FreeType. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted font, possibly resulting in execution of arbitrary code with the       privileges of the user running the application, or a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

Updated freetype2 packages fixes security vulnerabilities :

A NULL pointer de-reference flaw was found in the way Freetype font rendering engine handled Glyph bitmap distribution format (BDF) fonts.
A remote attacker could provide a specially crafted BDF font file, which once processed in an application linked against FreeType would lead to that application crash (CVE-2012-5668).

An out-of heap-based buffer read flaw was found in the way FreeType font rendering engine performed parsing of glyph information and relevant bitmaps for glyph bitmap distribution format (BDF). A remote attacker could provide a specially crafted BDF font file, which once opened in an application linked against FreeType would lead to that application crash (CVE-2012-5669).

An out-of heap-based buffer write flaw was found in the way FreeType font rendering engine performed parsing of glyph information and relevant bitmaps for glyph bitmap distribution format (BDF). A remote attacker could provide a specially crafted font file, which once opened in an application linked against FreeType would lead to that application crash, or, potentially, arbitrary code execution with the privileges of the user running the application (CVE-2012-5670).

New freetype packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix security issues.

Mateusz Jurczyk discovered that FreeType did not correctly handle certain malformed BDF font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash or possibly execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
80614	Oracle Solaris Third-Party Patch Update : freetype (multiple_buffer_errors_vulnerabilities_in)	Nessus	Solaris Local Security Checks	medium
75015	openSUSE Security Update : freetype2 (openSUSE-SU-2013:0165-1)	Nessus	SuSE Local Security Checks	medium
72453	GLSA-201402-16 : FreeType: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
66053	Mandriva Linux Security Advisory : freetype2 (MDVSA-2013:039)	Nessus	Mandriva Local Security Checks	medium
63555	Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : freetype (SSA:2013-015-01)	Nessus	Slackware Local Security Checks	medium
63536	Ubuntu 8.04 LTS / 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : freetype vulnerabilities (USN-1686-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2012-5670

high

Tenable Plugins

medium

medium

medium

medium

medium

medium