Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PCF file with a 0xffffffff size value that is improperly incremented.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - freetype: Use of uninitialized memory (CVE-2014-9746)

  - The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum     record size, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly     have unspecified other impact via a crafted TrueType font. (CVE-2014-9657)

  - The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum     table length, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly     have unspecified other impact via a crafted TrueType font. (CVE-2014-9658)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

CVE-2014-9657 The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.

CVE-2014-9658 The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.

CVE-2014-9660 The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font.

CVE-2014-9661 type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font.

CVE-2014-9663 The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table.

CVE-2014-9664 FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted Type42 font, related to type42/t42parse.c and type1/t1load.c.

CVE-2014-9667 sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted SFNT table.

CVE-2014-9669 Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have unspecified other impact via a crafted cmap SFNT table.

CVE-2014-9670 Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer overflow, NULL pointer dereference, and application crash) via a crafted PCF file that specifies negative values for the first column and first row.

CVE-2014-9671 Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PCF file with a 0xffffffff size value that is improperly incremented.

CVE-2014-9673 Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.

CVE-2014-9674 The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.

CVE-2014-9675 bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font.

Multiple integer overflow flaws and an integer signedness flaw, leading to heap-based buffer overflows, were found in the way FreeType handled Mac fonts. If a specially crafted font file was loaded by an application linked against FreeType, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2014-9673 , CVE-2014-9674)

Multiple flaws were found in the way FreeType handled fonts in various formats. If a specially crafted font file was loaded by an application linked against FreeType, it could cause the application to crash or, possibly, disclose a portion of the application memory. (CVE-2014-9657 , CVE-2014-9658 , CVE-2014-9660 , CVE-2014-9661 , CVE-2014-9663 , CVE-2014-9664 , CVE-2014-9667 , CVE-2014-9669 , CVE-2014-9670 , CVE-2014-9671 , CVE-2014-9675)

Mateusz Jurczyk discovered multiple vulnerabilities in Freetype.
Opening malformed fonts may result in denial of service or the execution of arbitrary code.

For the oldstable distribution (squeeze), these problems have been fixed in version 2.4.2-2.1+squeeze5.

For the stable distribution (wheezy), these problems were fixed in version 2.4.9-1.1+deb7u1.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

freetype2 was updated to fix various vulnerabilities that could lead to crashes or potentially code execution when parsing fonts.

Updated freetype2 packages fix security vulnerabilities :

It was reported that Freetype before 2.5.3 suffers from an out-of-bounds stack-based read/write flaw in cf2_hintmap_build() in the CFF rasterizing code, which could lead to a buffer overflow (CVE-2014-2240).

It was also reported that Freetype before 2.5.3 has a denial-of-service vulnerability in the CFF rasterizing code, due to a reachable assertion (CVE-2014-2241).

It was reported that Freetype before 2.5.4 suffers from an out-of-bounds stack-based read/write flaw in cf2_hintmap_build() in the CFF rasterizing code, which could lead to a buffer overflow. This is due to an incomplete fix for CVE-2014-2240.

The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType before 2.5.4 does not properly check for an integer overflow, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted OpenType font (CVE-2014-9656).

The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font (CVE-2014-9657).

The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font (CVE-2014-9658).

The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font (CVE-2014-9660).

type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font (CVE-2014-9661).

cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted OTF font (CVE-2014-9662).

The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table (CVE-2014-9663).

FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted Type42 font, related to type42/t42parse.c and type1/t1load.c (CVE-2014-9664).

The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted embedded bitmap (CVE-2014-9666).

sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted SFNT table (CVE-2014-9667).

Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have unspecified other impact via a crafted cmap SFNT table (CVE-2014-9669).

Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer overflow, NULL pointer dereference, and application crash) via a crafted PCF file that specifies negative values for the first column and first row (CVE-2014-9670).

Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PCF file with a 0xffffffff size value that is improperly incremented (CVE-2014-9671).

Array index error in the parse_fond function in base/ftmac.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information from process memory via a crafted FOND resource in a Mac font file (CVE-2014-9672).

Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font (CVE-2014-9673).

The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font (CVE-2014-9674).

bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font (CVE-2014-9675).

Multiple integer overflow flaws and an integer signedness flaw, leading to heap-based buffer overflows, were found in the way FreeType handled Mac fonts. If a specially crafted font file was loaded by an application linked against FreeType, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2014-9673, CVE-2014-9674)

Multiple flaws were found in the way FreeType handled fonts in various formats. If a specially crafted font file was loaded by an application linked against FreeType, it could cause the application to crash or, possibly, disclose a portion of the application memory.
(CVE-2014-9657, CVE-2014-9658, CVE-2014-9660, CVE-2014-9661, CVE-2014-9663, CVE-2014-9664, CVE-2014-9667, CVE-2014-9669, CVE-2014-9670, CVE-2014-9671, CVE-2014-9675)

The X server must be restarted (log out, then log back in) for this update to take effect.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fixes (CVE-2014-9657)

  - Check minimum size of `record_size'.

  - Fixes (CVE-2014-9658)

  - Use correct value for minimum table length test.

  - Fixes (CVE-2014-9675)

  - New macro that checks one character more than `strncmp'.

  - Fixes (CVE-2014-9660)

  - Check `_BDF_GLYPH_BITS'.

  - Fixes (CVE-2014-9661)

  - Initialize `face->ttf_size'.

  - Always set `face->ttf_size' directly.

  - Exclusively use the `truetype' font driver for loading     the font contained in the `sfnts' array.

  - Fixes (CVE-2014-9663)

  - Fix order of validity tests.

  - Fixes (CVE-2014-9664)

  - Add another boundary testing.

  - Fix boundary testing.

  - Fixes (CVE-2014-9667)

  - Protect against addition overflow.

  - Fixes (CVE-2014-9669)

  - Protect against overflow in additions and     multiplications.

  - Fixes (CVE-2014-9670)

  - Add sanity checks for row and column values.

  - Fixes (CVE-2014-9671)

  - Check `size' and `offset' values.

  - Fixes (CVE-2014-9673)

  - Fix integer overflow by a broken POST table in     resource-fork.

  - Fixes (CVE-2014-9674)

  - Fix integer overflow by a broken POST table in     resource-fork.

  - Additional overflow check in the summation of POST     fragment lengths.

  - Work around behaviour of X11's `pcfWriteFont' and     `pcfReadFont' functions

  - Resolves: #1197737

  - Fix (CVE-2012-5669) (Use correct array size for checking     `glyph_enc')

  - Resolves: #903543

Updated freetype2 packages fix security vulnerabilities :

The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType before 2.5.4 does not properly check for an integer overflow, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted OpenType font (CVE-2014-9656).

The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font (CVE-2014-9657).

The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font (CVE-2014-9658).

The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font (CVE-2014-9660).

type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font (CVE-2014-9661).

The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table (CVE-2014-9663).

FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted Type42 font, related to type42/t42parse.c and type1/t1load.c (CVE-2014-9664).

The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted embedded bitmap (CVE-2014-9666).

sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted SFNT table (CVE-2014-9667).

Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have unspecified other impact via a crafted cmap SFNT table (CVE-2014-9669).

Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer overflow, NULL pointer dereference, and application crash) via a crafted PCF file that specifies negative values for the first column and first row (CVE-2014-9670).

Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PCF file with a 0xffffffff size value that is improperly incremented (CVE-2014-9671).

Array index error in the parse_fond function in base/ftmac.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information from process memory via a crafted FOND resource in a Mac font file (CVE-2014-9672).

Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font (CVE-2014-9673).

The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font (CVE-2014-9674).

bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font (CVE-2014-9675).

Updated freetype packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently.

Multiple integer overflow flaws and an integer signedness flaw, leading to heap-based buffer overflows, were found in the way FreeType handled Mac fonts. If a specially crafted font file was loaded by an application linked against FreeType, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2014-9673, CVE-2014-9674)

Multiple flaws were found in the way FreeType handled fonts in various formats. If a specially crafted font file was loaded by an application linked against FreeType, it could cause the application to crash or, possibly, disclose a portion of the application memory.
(CVE-2014-9657, CVE-2014-9658, CVE-2014-9660, CVE-2014-9661, CVE-2014-9663, CVE-2014-9664, CVE-2014-9667, CVE-2014-9669, CVE-2014-9670, CVE-2014-9671, CVE-2014-9675)

All freetype users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The X server must be restarted (log out, then log back in) for this update to take effect.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0696 advisory.

    - Fixes CVE-2014-9657
       - Check minimum size of record_size.
    - Fixes CVE-2014-9658
       - Use correct value for minimum table length test.
    - Fixes CVE-2014-9675
       - New macro that checks one character more than strncmp.
    - Fixes CVE-2014-9660
       - Check _BDF_GLYPH_BITS.
    - Fixes CVE-2014-9661
       - Initialize face->ttf_size.
       - Always set face->ttf_size directly.
       - Exclusively use the truetype font driver for loading          the font contained in the sfnts array.
    - Fixes CVE-2014-9663
       - Fix order of validity tests.
    - Fixes CVE-2014-9664
       - Add another boundary testing.
       - Fix boundary testing.
    - Fixes CVE-2014-9667
       - Protect against addition overflow.
    - Fixes CVE-2014-9669
       - Protect against overflow in additions and multiplications.
    - Fixes CVE-2014-9670
       - Add sanity checks for row and column values.
    - Fixes CVE-2014-9671
       - Check size and offset values.
    - Fixes CVE-2014-9673
       - Fix integer overflow by a broken POST table in resource-fork.
    - Fixes CVE-2014-9674
       - Fix integer overflow by a broken POST table in resource-fork.
       - Additional overflow check in the summation of POST fragment lengths.
    - Fix CVE-2012-5669         (Use correct array size for checking glyph_enc)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mateusz Jurczyk discovered multiple vulnerabilities in Freetype.
Opening malformed fonts may result in denial of service or the execution of arbitrary code.

The font rendering library freetype2 has been updated to fix various security issues.

The remote host is affected by the vulnerability described in GLSA-201503-05 (FreeType: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FreeType. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker can cause Denial of Service.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2510-1 advisory.

    Mateusz Jurczyk discovered that FreeType did not correctly handle certain malformed font files. If a user     were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash or     possibly execute arbitrary code with user privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198698	RHEL 5 : freetype (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
91368	F5 Networks BIG-IP : Multiple FreeType vulnerabilities (K16900)	Nessus	F5 Networks Local Security Checks	high
82509	Amazon Linux AMI : freetype (ALAS-2015-502)	Nessus	Amazon Linux Local Security Checks	high
82479	Debian DLA-185-1 : freetype security update	Nessus	Debian Local Security Checks	high
82461	openSUSE Security Update : freetype2 (openSUSE-2015-274)	Nessus	SuSE Local Security Checks	high
82342	Mandriva Linux Security Advisory : freetype2 (MDVSA-2015:089)	Nessus	Mandriva Local Security Checks	high
82262	Scientific Linux Security Update : freetype on SL6.x, SL7.x i386/x86_64 (20150318)	Nessus	Scientific Linux Local Security Checks	high
81967	OracleVM 3.3 : freetype (OVMSA-2015-0036)	Nessus	OracleVM Local Security Checks	high
81938	Mandriva Linux Security Advisory : freetype2 (MDVSA-2015:055)	Nessus	Mandriva Local Security Checks	high
81924	CentOS 6 / 7 : freetype (CESA-2015:0696)	Nessus	CentOS Local Security Checks	high
81907	RHEL 7 : freetype (RHSA-2015:0696)	Nessus	Red Hat Local Security Checks	high
81902	Oracle Linux 6 / 7 : freetype (ELSA-2015-0696)	Nessus	Oracle Linux Local Security Checks	medium
81832	Debian DSA-3188-1 : freetype - security update	Nessus	Debian Local Security Checks	high
81752	SuSE 11.3 Security Update : freetype2 (SAT Patch Number 10386)	Nessus	SuSE Local Security Checks	high
81690	GLSA-201503-05 : FreeType: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
81509	Ubuntu 14.04 LTS : FreeType vulnerabilities (USN-2510-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2014-9671

medium

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

medium

high

high

high

medium