Bug 1191080 (CVE-2014-9658)
| Summary: | CVE-2014-9658 freetype: buffer over-read and integer underflow in tt_face_load_kern() | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Vasyl Kaigorodov <vkaigoro> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | behdad, fonts-bugs, kevin, mkasik |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | freetype 2.5.4 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-03-18 07:41:00 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1191099, 1197737, 1197738, 1197739, 1197740 | ||
| Bug Blocks: | 1191102 | ||
|
Description
Vasyl Kaigorodov
2015-02-10 12:50:17 UTC
Created freetype tracking bugs for this issue: Affects: fedora-all [bug 1191099] freetype-2.5.3-15.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report. Upstream bug is: https://savannah.nongnu.org/bugs/?43672 Issue was fixed upstream in 2.5.4. The issue here starts as a simple short buffer over-read. Existing check to ensure enough input data is still available was incorrect: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/src/sfnt/ttkern.c?id=73be9f9#n102 The length <= 6 only takes into account the previously read header: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/src/sfnt/ttkern.c?id=73be9f9#n96 p is later incremented by 8 (but only the first two bytes are actually read/accessed): http://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/src/sfnt/ttkern.c?id=73be9f9#n115 However, when length is too short, p_next may be less than p, which leads to integer underflow in (p_next - p) in this num_pairs check: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/src/sfnt/ttkern.c?id=73be9f9#n118 The check aims to prevent further over-reads. Underflow bypasses the check and makes it possible to read 6 * 0xffff bytes (num_pairs is short). Crash should be possible. freetype-2.5.0-9.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report. This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Via RHSA-2015:0696 https://rhn.redhat.com/errata/RHSA-2015-0696.html |