- BNC#795826, CVE-2012-5668.patch [bdf] Fix Savannah bug     #37905.

  - src/bdf/bdflib.c (_bdf_parse_start): Reset `props_size'     to zero in case of allocation error; this value gets     used in a loop in

  - BNC#795826, CVE-2012-5669.patch [bdf] Fix Savannah bug     #37906.

  - src/bdf/bdflib.c (_bdf_parse_glyphs): Use correct array     size for checking `glyph_enc'.

  - BNC#795826, CVE-2012-5670.patch [bdf] Fix Savannah bug     #37907.

  - src/bdf/bdflib.c (_bdf_parse_glyphs) <ENCODING>:
    Normalize negative second parameter of `ENCODING' field     also.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - freetype: Use of uninitialized memory (CVE-2014-9746)

  - FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (NULL pointer     dereference and crash) via vectors related to BDF fonts and the improper handling of an allocation error     in the bdf_free_font function. (CVE-2012-5668)

  - The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a     denial of service (infinite loop) via a broken number-with-base in a Postscript stream, as demonstrated     by 8#garbage. (CVE-2014-9745)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update fixes :

  - OOB access in bdf_free_font() (CVE-2012-5668) As well as     non-security bugs :

  - [bdf] Savannah bug #37905. o src/bdf/bdflib.c     (_bdf_parse_start): Reset `props_size' to zero in case     of allocation error; this value gets used in a loop in

Multiple vulnerabilities has been found and corrected in freetype2 :

A NULL pointer de-reference flaw was found in the way Freetype font rendering engine handled Glyph bitmap distribution format (BDF) fonts.
A remote attacker could provide a specially crafted BDF font file, which once processed in an application linked against FreeType would lead to that application crash (CVE-2012-5668).

An out-of heap-based buffer read flaw was found in the way FreeType font rendering engine performed parsing of glyph information and relevant bitmaps for glyph bitmap distribution format (BDF). A remote attacker could provide a specially crafted BDF font file, which once opened in an application linked against FreeType would lead to that application crash (CVE-2012-5669).

The updated packages have been patched to correct these issues.

The remote host is affected by the vulnerability described in GLSA-201402-16 (FreeType: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FreeType. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted font, possibly resulting in execution of arbitrary code with the       privileges of the user running the application, or a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

Mateusz Jurczyk discovered that FreeType did not correctly handle certain malformed BDF font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash or possibly execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes :

  - OOB access in bdf_free_font() and _bdf_parse_glyphs()     (CVE-2012-5668 / CVE-2012-5669) As well as the following     non-security bugs :

  - [bdf] Savannah bug #37905.

  - src/bdf/bdflib.c (_bdf_parse_start): Reset `props_size'     to zero in case of allocation error; this value gets     used in a loop in

  - [bdf] Fix Savannah bug #37906.

  - src/bdf/bdflib.c (_bdf_parse_glyphs): Use correct array     size for checking `glyph_enc'.

Updated freetype2 packages fixes security vulnerabilities :

A NULL pointer de-reference flaw was found in the way Freetype font rendering engine handled Glyph bitmap distribution format (BDF) fonts.
A remote attacker could provide a specially crafted BDF font file, which once processed in an application linked against FreeType would lead to that application crash (CVE-2012-5668).

An out-of heap-based buffer read flaw was found in the way FreeType font rendering engine performed parsing of glyph information and relevant bitmaps for glyph bitmap distribution format (BDF). A remote attacker could provide a specially crafted BDF font file, which once opened in an application linked against FreeType would lead to that application crash (CVE-2012-5669).

An out-of heap-based buffer write flaw was found in the way FreeType font rendering engine performed parsing of glyph information and relevant bitmaps for glyph bitmap distribution format (BDF). A remote attacker could provide a specially crafted font file, which once opened in an application linked against FreeType would lead to that application crash, or, potentially, arbitrary code execution with the privileges of the user running the application (CVE-2012-5670).

New freetype packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix security issues.

- new license string.

  - BNC#795826, CVE-2012-5668.patch

  - BNC#795826, CVE-2012-5669.patch [bdf] Fix Savannah bug     #37906.

  - src/bdf/bdflib.c (_bdf_parse_glyphs): Use correct array     size for checking `glyph_enc'.

The remote Solaris system is missing necessary patches to address security updates :

  - FreeType before 2.4.11 allows context-dependent     attackers to cause a denial of service (NULL pointer     dereference and crash) via vectors related to BDF fonts     and the improper handling of an 'allocation error' in     the bdf_free_font function. (CVE-2012-5668)

  - The _bdf_parse_glyphs function in FreeType before 2.4.11     allows context-dependent attackers to cause a denial of     service (crash) and possibly execute arbitrary code via     vectors related to BDF fonts and an incorrect     calculation that triggers an out-of-bounds read.
    (CVE-2012-5669)

  - The _bdf_parse_glyphs function in FreeType before 2.4.11     allows context-dependent attackers to cause a denial of     service (out-of-bounds write and crash) via vectors     related to BDF fonts and an ENCODING field with a     negative value. (CVE-2012-5670)

ID	Name	Product	Family	Published	Updated	Severity
75015	openSUSE Security Update : freetype2 (openSUSE-SU-2013:0165-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	medium
198605	RHEL 6 : freetype (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	critical
64092	SuSE 10 Security Update : freetype2 (ZYPP Patch Number 8433)	Nessus	SuSE Local Security Checks	1/25/2013	1/19/2021	medium
64504	Mandriva Linux Security Advisory : freetype2 (MDVSA-2013:006)	Nessus	Mandriva Local Security Checks	2/9/2013	1/6/2021	medium
72453	GLSA-201402-16 : FreeType: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2/12/2014	1/6/2021	medium
63536	Ubuntu 8.04 LTS / 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : freetype vulnerabilities (USN-1686-1)	Nessus	Ubuntu Local Security Checks	1/15/2013	9/19/2019	medium
64144	SuSE 11.2 Security Update : freetype2 (SAT Patch Number 7232)	Nessus	SuSE Local Security Checks	1/25/2013	1/19/2021	medium
66053	Mandriva Linux Security Advisory : freetype2 (MDVSA-2013:039)	Nessus	Mandriva Local Security Checks	4/20/2013	1/6/2021	medium
63555	Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : freetype (SSA:2013-015-01)	Nessus	Slackware Local Security Checks	1/16/2013	1/14/2021	medium
75003	openSUSE Security Update : freetype2 (openSUSE-SU-2013:0177-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	medium
80614	Oracle Solaris Third-Party Patch Update : freetype (multiple_buffer_errors_vulnerabilities_in)	Nessus	Solaris Local Security Checks	1/19/2015	1/14/2021	medium

Detections

Analytics

Plugins Search

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium