Detections
Analytics
Amazon Linux AMI : t1lib (ALAS-2012-40)
high Nessus Plugin ID 69647
Language:
Synopsis
The remote Amazon Linux AMI host is missing a security update.Description
Two heap-based buffer overflow flaws were found in the way t1lib processed Adobe Font Metrics (AFM) files. If a specially crafted font file was opened by an application linked against t1lib, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2010-2642 , CVE-2011-0433)An invalid pointer dereference flaw was found in t1lib. A specially crafted font file could, when opened, cause an application linked against t1lib to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2011-0764)
A use-after-free flaw was found in t1lib. A specially crafted font file could, when opened, cause an application linked against t1lib to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2011-1553)
An off-by-one flaw was found in t1lib. A specially crafted font file could, when opened, cause an application linked against t1lib to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2011-1554)
An out-of-bounds memory read flaw was found in t1lib. A specially crafted font file could, when opened, cause an application linked against t1lib to crash. (CVE-2011-1552)
Solution
Run 'yum update t1lib' to update your system.See Also
Plugin Details
Severity: High
ID: 69647
File Name: ala_ALAS-2012-40.nasl
Version: 1.6
Type: local
Agent: unix
Published: 9/4/2013
Updated: 4/18/2018
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.6
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:amazon:linux:t1lib-debuginfo, p-cpe:/a:amazon:linux:t1lib-apps, p-cpe:/a:amazon:linux:t1lib-static, p-cpe:/a:amazon:linux:t1lib-devel, p-cpe:/a:amazon:linux:t1lib, cpe:/o:amazon:linux
Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list
Patch Publication Date: 2/2/2012
Reference Information
CVE: CVE-2010-2642, CVE-2011-0764, CVE-2011-1552, CVE-2011-1553, CVE-2011-1554