The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - freetype: Use of uninitialized memory (CVE-2014-9746)

  - The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum     record size, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly     have unspecified other impact via a crafted TrueType font. (CVE-2014-9657)

  - The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum     table length, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly     have unspecified other impact via a crafted TrueType font. (CVE-2014-9658)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - freetype: heap-based buffer overflow related to the t1_builder_close_contour function (CVE-2017-8287)

  - The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a     denial of service (infinite loop) via a broken number-with-base in a Postscript stream, as demonstrated     by 8#garbage. (CVE-2014-9745)

  - The (1) t1_parse_font_matrix function in type1/t1load.c, (2) cid_parse_font_matrix function in     cid/cidload.c, (3) t42_parse_font_matrix function in type42/t42parse.c, and (4) ps_parser_load_field     function in psaux/psobjs.c in FreeType before 2.5.4 do not check return values, which allows remote     attackers to cause a denial of service (uninitialized memory access and application crash) or possibly     have unspecified other impact via a crafted font. (CVE-2014-9746)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - freetype: Use of uninitialized memory (CVE-2014-9746)

  - FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (NULL pointer     dereference and crash) via vectors related to BDF fonts and the improper handling of an allocation error     in the bdf_free_font function. (CVE-2012-5668)

  - The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a     denial of service (infinite loop) via a broken number-with-base in a Postscript stream, as demonstrated     by 8#garbage. (CVE-2014-9745)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the freetype package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The FreeType engine is a free and portable font     rendering engine, developed to provide advanced font     support for a variety of platforms and environments.
    FreeType is a library which can open and manages font     files as well as efficiently load, hint and render     individual glyphs. FreeType is not a font server or a     complete text-rendering library. Security Fix(es):The     t42_parse_encoding function in type42/t42parse.c in     FreeType before 2.5.4 does not properly update the     current position for immediates-only mode, which allows     remote attackers to cause a denial of service (infinite     loop) via a Type42 font.(CVE-2014-9747)In Sudo before     1.8.28, an attacker with access to a Runas ALL sudoer     account can bypass certain policy blacklists and     session PAM modules, and can cause incorrect logging,     by invoking sudo with a crafted user ID. For example,     this allows bypass of !root configuration, and USER=     logging, for a 'sudo -u \#$((0xffffffff))'     command.(CVE-2015-9383)FreeType before 2.6.1 has a     buffer over-read in skip_comment in psaux/psobjs.c     because ps_parser_skip_PS_token is mishandled in an     FT_New_Memory_Face operation.(CVE-2015-9382)FreeType     before 2.6.1 has a heap-based buffer over-read in     T1_Get_Private_Dict in     type1/t1parse.c.(CVE-2015-9381)In FreeType before     2.6.1, a buffer over-read occurs in type1/t1parse.c on     function T1_Get_Private_Dict where there is no check     that the new values of cur and limit are sensible     before going to Again.(CVE-2015-9290)The parse_encoding     function in type1/t1load.c in FreeType before 2.5.3     allows remote attackers to cause a denial of service     (infinite loop) via a 'broken number-with-base' in a     Postscript stream, as demonstrated by     8#garbage.(CVE-2014-9745)The parse_charstrings function     in type1/t1load.c in FreeType 2 before 2.7 does not     ensure that a font contains a glyph name, which allows     remote attackers to cause a denial of service     (heap-based buffer over-read) or possibly have     unspecified other impact via a crafted     file.(CVE-2016-10244)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for freetype2 fixes the following issues: Security issue fixed :

  - CVE-2016-10244: The parse_charstrings function in     type1/t1load.c did not ensure that a font contains a     glyph name, which allowed remote attackers to cause a     denial of service (heap-based buffer over-read) or     possibly have unspecified other impact via a crafted     file (bsc#1028103).

  - CVE-2017-8105: Fixed an out-of-bounds write caused by a     heap-based buffer overflow related to the     t1_decoder_parse_charstrings function in     psaux/t1decode.ca (bsc#1035807)

  - CVE-2017-8287: an out-of-bounds write caused by a     heap-based buffer overflow related to the     t1_builder_close_contour function in psaux/psobjs.c     (bsc#1036457)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for freetype2 fixes the following security issues :

  - CVE-2016-10244: Make sure that the parse_charstrings     function in type1/t1load.c does ensure that a font     contains a glyph name to prevent a DoS through a     heap-based buffer over-read or possibly have unspecified     other impact via a crafted file (bsc#1028103)

  - CVE-2017-8105: Fix an out-of-bounds write caused by a     heap-based buffer overflow related to the     t1_decoder_parse_charstrings function in     psaux/t1decode.ca (bsc#1035807)

  - CVE-2017-8287: an out-of-bounds write caused by a     heap-based buffer overflow related to the     t1_builder_close_contour function in psaux/psobjs.c     (bsc#1036457)

  - Fix several integer overflow issues in     truetype/ttinterp.c (bsc#1079600)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for freetype2 fixes the following security issues :

  - CVE-2016-10244: Make sure that the parse_charstrings     function in type1/t1load.c does ensure that a font     contains a glyph name to prevent a DoS through a     heap-based buffer over-read or possibly have unspecified     other impact via a crafted file (bsc#1028103)

  - CVE-2017-8105: Fix an out-of-bounds write caused by a     heap-based buffer overflow related to the     t1_decoder_parse_charstrings function in     psaux/t1decode.ca (bsc#1035807)

  - CVE-2017-8287: an out-of-bounds write caused by a     heap-based buffer overflow related to the     t1_builder_close_contour function in psaux/psobjs.c     (bsc#1036457)

  - Fix several integer overflow issues in     truetype/ttinterp.c (bsc#1079600)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

The remote host is affected by the vulnerability described in GLSA-201706-14 (FreeType: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FreeType. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to use a specially crafted font       file using FreeType, possibly resulting in execution of arbitrary code       with the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities were discovered in Freetype. Opening malformed fonts may result in denial of service or the execution of arbitrary code.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3237-1 advisory.

    It was discovered that FreeType did not correctly handle certain malformed font files. If a user were     tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash,     resulting in a denial of service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update fixes a possible heap buffer overflow.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was a denial of service vulnerability in freetype, a font rendering library.

The parse_charstrings function did not ensure that a font contains a glyph name, which allowed remote attackers to cause a denial of service via a specially crafted file.

For Debian 7 'Wheezy', this issue has been fixed in freetype version 2.4.9-1.1+deb7u4.

We recommend that you upgrade your freetype packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198698	RHEL 5 : freetype (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198633	RHEL 7 : freetype (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198605	RHEL 6 : freetype (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
134513	EulerOS Virtualization for ARM 64 3.0.2.0 : freetype (EulerOS-SA-2020-1224)	Nessus	Huawei Local Security Checks	critical
106896	SUSE SLES11 Security Update : freetype2 (SUSE-SU-2018:0462-1)	Nessus	SuSE Local Security Checks	critical
106747	SUSE SLED12 / SLES12 Security Update : freetype2 (SUSE-SU-2018:0414-1)	Nessus	SuSE Local Security Checks	critical
106743	openSUSE Security Update : freetype2 (openSUSE-2018-156)	Nessus	SuSE Local Security Checks	critical
100657	GLSA-201706-14 : FreeType: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
99742	Debian DSA-3839-1 : freetype - security update	Nessus	Debian Local Security Checks	critical
97854	Ubuntu 14.04 LTS / 16.04 LTS : FreeType vulnerability (USN-3237-1)	Nessus	Ubuntu Local Security Checks	high
97701	Fedora 24 : freetype (2017-3886afeb06)	Nessus	Fedora Local Security Checks	high
97682	Fedora 25 : freetype (2017-c09c0cc384)	Nessus	Fedora Local Security Checks	high
97588	Debian DLA-848-1 : freetype security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-10244

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

high

high