An issue was discovered in FreeType 2 through 2.9. A NULL pointer dereference in the Ins_GETVARIATION() function within ttinterp.c could lead to DoS via a crafted font file.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - freetype: Use of uninitialized memory (CVE-2014-9746)

  - The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum     record size, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly     have unspecified other impact via a crafted TrueType font. (CVE-2014-9657)

  - The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum     table length, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly     have unspecified other impact via a crafted TrueType font. (CVE-2014-9658)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - freetype: heap-based buffer overflow related to the t1_builder_close_contour function (CVE-2017-8287)

  - The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a     denial of service (infinite loop) via a broken number-with-base in a Postscript stream, as demonstrated     by 8#garbage. (CVE-2014-9745)

  - The (1) t1_parse_font_matrix function in type1/t1load.c, (2) cid_parse_font_matrix function in     cid/cidload.c, (3) t42_parse_font_matrix function in type42/t42parse.c, and (4) ps_parser_load_field     function in psaux/psobjs.c in FreeType before 2.5.4 do not check return values, which allows remote     attackers to cause a denial of service (uninitialized memory access and application crash) or possibly     have unspecified other impact via a crafted font. (CVE-2014-9746)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - freetype: Use of uninitialized memory (CVE-2014-9746)

  - FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (NULL pointer     dereference and crash) via vectors related to BDF fonts and the improper handling of an allocation error     in the bdf_free_font function. (CVE-2012-5668)

  - The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a     denial of service (infinite loop) via a broken number-with-base in a Postscript stream, as demonstrated     by 8#garbage. (CVE-2014-9745)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

This update for freetype2 to version 2.10.1 fixes the following issues :

Security issue fixed :

  - CVE-2018-6942: Fixed a NULL pointer dereference within     ttinerp.c (bsc#1079603).

Non-security issues fixed :

  - Update to version 2.10.1

  - The bytecode hinting of OpenType variation fonts was     flawed, since the data in the `CVAR' table wasn't     correctly applied.

  - Auto-hinter support for Mongolian.

  - The handling of the default character in PCF fonts as     introduced in version 2.10.0 was partially broken,     causing premature abortion of charmap iteration for many     fonts.

  - If `FT_Set_Named_Instance' was called with the same     arguments twice in a row, the function returned an     incorrect error code the second time.

  - Direct rendering using FT_RASTER_FLAG_DIRECT crashed     (bug introduced in version 2.10.0).

  - Increased precision while computing OpenType font     variation instances.

  - The flattening algorithm of cubic Bezier curves was     slightly changed to make it faster. This can cause very     subtle rendering changes, which aren't noticeable by the     eye, however.

  - The auto-hinter now disables hinting if there are blue     zones defined for a `style' (i.e., a certain combination     of a script and its related typographic features) but     the font doesn't contain any characters needed to set up     at least one blue zone.

  - Add tarball signatures and freetype2.keyring

  - Update to version 2.10.0

  - A bunch of new functions has been added to access and     process COLR/CPAL data of OpenType fonts with     color-layered glyphs.

  - As a GSoC 2018 project, Nikhil Ramakrishnan completely     overhauled and modernized the API reference.

  - The logic for computing the global ascender, descender,     and height of OpenType fonts has been slightly adjusted     for consistency.

  - `TT_Set_MM_Blend' could fail if called repeatedly with     the same arguments.

  - The precision of handling deltas in Variation Fonts has     been increased.The problem did only show up with     multidimensional designspaces.

  - New function `FT_Library_SetLcdGeometry' to set up the     geometry of LCD subpixels.

  - FreeType now uses the `defaultChar' property of PCF     fonts to set the glyph for the undefined character at     glyph index 0 (as FreeType already does for all other     supported font formats). As a consequence, the order of     glyphs of a PCF font if accessed with FreeType can be     different now compared to previous versions. This change     doesn't affect PCF font access with cmaps.

  - `FT_Select_Charmap' has been changed to allow parameter     value `FT_ENCODING_NONE', which is valid for BDF, PCF,     and Windows FNT formats to access built-in cmaps that     don't have a predefined `FT_Encoding' value.

  - A previously reserved field in the `FT_GlyphSlotRec'     structure now holds the glyph index.

  - The usual round of fuzzer bug fixes to better reject     malformed fonts.

  - `FT_Outline_New_Internal' and `FT_Outline_Done_Internal'     have been removed.These two functions were public by     oversight only and were never documented.

  - A new function `FT_Error_String' returns descriptions of     error codes if configuration macro     FT_CONFIG_OPTION_ERROR_STRINGS is defined.

  - `FT_Set_MM_WeightVector' and `FT_Get_MM_WeightVector'     are new functions limited to Adobe MultiMaster fonts to     directly set and get the weight vector.

  - Enable subpixel rendering with infinality config :

  - Re-enable freetype-config, there is just too many     fallouts. 

  - Update to version 2.9.1

  - Type 1 fonts containing flex features were not rendered     correctly (bug introduced in version 2.9).

  - CVE-2018-6942: Older FreeType versions can crash with     certain malformed variation fonts.

  - Bug fix: Multiple calls to `FT_Get_MM_Var' returned     garbage.

  - Emboldening of bitmaps didn't work correctly sometimes,     showing various artifacts (bug introduced in version     2.8.1).

  - The auto-hinter script ranges have been updated for     Unicode 11. No support for new scripts have been added,     however, with the exception of Georgian Mtavruli.

  - freetype-config is now deprecated by upstream and not     enabled by default.

  - Update to version 2.10.1

  - The `ftmulti' demo program now supports multiple hidden     axes with the same name tag.

  - `ftview', `ftstring', and `ftgrid' got a `-k' command     line option to emulate a sequence of keystrokes at     start-up.

  - `ftview', `ftstring', and `ftgrid' now support screen     dumping to a PNG file.

  - The bytecode debugger, `ttdebug', now supports variation     TrueType fonts; a variation font instance can be     selected with the new `-d' command line option.

  - Add tarball signatures and freetype2.keyring

  - Update to version 2.10.0

  - The `ftdump' demo program has new options `-c' and `-C'     to display charmaps in compact and detailed format,     respectively. Option `-V' has been removed.

  - The `ftview', `ftstring', and `ftgrid' demo programs use     a new command line option `-d' to specify the program     window's width, height, and color depth.

  - The `ftview' demo program now displays red boxes for     zero-width glyphs.

  - `ftglyph' has limited support to display fonts with     color-layered glyphs.This will be improved later on.

  - `ftgrid' can now display bitmap fonts also.

  - The `ttdebug' demo program has a new option `-f' to     select a member of a TrueType collection (TTC).

  - Other various improvements to the demo programs.

  - Remove 'Supplements: fonts-config' to avoid accidentally     pulling in Qt dependencies on some non-Qt based     desktops.(bsc#1091109) fonts-config is fundamental but     ft2demos seldom installs by end users. only fonts-config     maintainers/debuggers may use ft2demos along to debug     some issues. 

  - Update to version 2.9.1

  - No changelog upstream.

This update was imported from the SUSE:SLE-15:Update update project.

This update for freetype2 to version 2.10.1 fixes the following issues :

Security issue fixed :

CVE-2018-6942: Fixed a NULL pointer dereference within ttinerp.c (bsc#1079603).

Non-security issues fixed :

Update to version 2.10.1

  - The bytecode hinting of OpenType variation fonts was     flawed, since the data in the `CVAR' table wasn't     correctly applied.

  - Auto-hinter support for Mongolian.

  - The handling of the default character in PCF fonts as     introduced in version 2.10.0 was partially broken,     causing premature abortion of charmap iteration for many     fonts.

  - If `FT_Set_Named_Instance' was called with the same     arguments twice in a row, the function returned an     incorrect error code the second time.

  - Direct rendering using FT_RASTER_FLAG_DIRECT crashed     (bug introduced in version 2.10.0).

  - Increased precision while computing OpenType font     variation instances.

  - The flattening algorithm of cubic Bezier curves was     slightly changed to make it faster. This can cause very     subtle rendering changes, which aren't noticeable by the     eye, however.

  - The auto-hinter now disables hinting if there are blue     zones defined for a `style' (i.e., a certain combination     of a script and its related typographic features) but     the font doesn't contain any characters needed to set up     at least one blue zone.

Add tarball signatures and freetype2.keyring

Update to version 2.10.0

  - A bunch of new functions has been added to access and     process COLR/CPAL data of OpenType fonts with     color-layered glyphs.

  - As a GSoC 2018 project, Nikhil Ramakrishnan completely     overhauled and modernized the API reference.

  - The logic for computing the global ascender, descender,     and height of OpenType fonts has been slightly adjusted     for consistency.

  - `TT_Set_MM_Blend' could fail if called repeatedly with     the same arguments.

  - The precision of handling deltas in Variation Fonts has     been increased.The problem did only show up with     multidimensional designspaces.

  - New function `FT_Library_SetLcdGeometry' to set up the     geometry of LCD subpixels.

  - FreeType now uses the `defaultChar' property of PCF     fonts to set the glyph for the undefined character at     glyph index 0 (as FreeType already does for all other     supported font formats). As a consequence, the order of     glyphs of a PCF font if accessed with FreeType can be     different now compared to previous versions. This change     doesn't affect PCF font access with cmaps.

  - `FT_Select_Charmap' has been changed to allow parameter     value `FT_ENCODING_NONE', which is valid for BDF, PCF,     and Windows FNT formats to access built-in cmaps that     don't have a predefined `FT_Encoding' value.

  - A previously reserved field in the `FT_GlyphSlotRec'     structure now holds the glyph index.

  - The usual round of fuzzer bug fixes to better reject     malformed fonts.

  - `FT_Outline_New_Internal' and `FT_Outline_Done_Internal'     have been removed.These two functions were public by     oversight only and were never documented.

  - A new function `FT_Error_String' returns descriptions of     error codes if configuration macro     FT_CONFIG_OPTION_ERROR_STRINGS is defined.

  - `FT_Set_MM_WeightVector' and `FT_Get_MM_WeightVector'     are new functions limited to Adobe MultiMaster fonts to     directly set and get the weight vector.

Enable subpixel rendering with infinality config :

Re-enable freetype-config, there is just too many fallouts.

Update to version 2.9.1

  - Type 1 fonts containing flex features were not rendered     correctly (bug introduced in version 2.9).

  - CVE-2018-6942: Older FreeType versions can crash with     certain malformed variation fonts.

  - Bug fix: Multiple calls to `FT_Get_MM_Var' returned     garbage.

  - Emboldening of bitmaps didn't work correctly sometimes,     showing various artifacts (bug introduced in version     2.8.1).

  - The auto-hinter script ranges have been updated for     Unicode 11. No support for new scripts have been added,     however, with the exception of Georgian Mtavruli.

freetype-config is now deprecated by upstream and not enabled by default.

Update to version 2.10.1

  - The `ftmulti' demo program now supports multiple hidden     axes with the same name tag.

  - `ftview', `ftstring', and `ftgrid' got a `-k' command     line option to emulate a sequence of keystrokes at     start-up.

  - `ftview', `ftstring', and `ftgrid' now support screen     dumping to a PNG file.

  - The bytecode debugger, `ttdebug', now supports variation     TrueType fonts; a variation font instance can be     selected with the new `-d' command line option.

Add tarball signatures and freetype2.keyring

Update to version 2.10.0

  - The `ftdump' demo program has new options `-c' and `-C'     to display charmaps in compact and detailed format,     respectively. Option `-V' has been removed.

  - The `ftview', `ftstring', and `ftgrid' demo programs use     a new command line option `-d' to specify the program     window's width, height, and color depth.

  - The `ftview' demo program now displays red boxes for     zero-width glyphs.

  - `ftglyph' has limited support to display fonts with     color-layered glyphs.This will be improved later on.

  - `ftgrid' can now display bitmap fonts also.

  - The `ttdebug' demo program has a new option `-f' to     select a member of a TrueType collection (TTC).

  - Other various improvements to the demo programs.

Remove 'Supplements: fonts-config' to avoid accidentally pulling in Qt dependencies on some non-Qt based desktops.(bsc#1091109) fonts-config is fundamental but ft2demos seldom installs by end users. only fonts-config maintainers/debuggers may use ft2demos along to debug some issues.

Update to version 2.9.1

  - No changelog upstream.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the freetype2 package has been released.

Security fix for CVE-2018-6942.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that FreeType incorrectly handled certain files. An attacker could possibly use this to cause a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198698	RHEL 5 : freetype (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198633	RHEL 7 : freetype (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198605	RHEL 6 : freetype (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196463	RHEL 6 : freetype (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
196401	RHEL 7 : freetype (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
136887	openSUSE Security Update : freetype2 (openSUSE-2020-704)	Nessus	SuSE Local Security Checks	medium
136800	SUSE SLED15 / SLES15 Security Update : freetype2 (SUSE-SU-2020:1353-1)	Nessus	SuSE Local Security Checks	medium
121955	Photon OS 2.0: Freetype2 PHSA-2018-2.0-0058	Nessus	PhotonOS Local Security Checks	medium
121846	Photon OS 1.0: Freetype2 PHSA-2018-1.0-0148	Nessus	PhotonOS Local Security Checks	medium
106905	Fedora 27 : freetype (2018-07a3e36499)	Nessus	Fedora Local Security Checks	medium
106839	Ubuntu 17.10 : freetype vulnerability (USN-3572-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2018-6942

medium

Tenable Plugins

critical

critical

critical

high

critical

medium

medium

medium

medium

medium

medium