Bug 1191096 (CVE-2014-9673)
Summary: | CVE-2014-9673 freetype: integer signedness error in Mac_Read_POST_Resource() leading to heap-based buffer overflow | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Vasyl Kaigorodov <vkaigoro> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | high | Docs Contact: | |
Priority: | high | ||
Version: | unspecified | CC: | behdad, fonts-bugs, kevin, mkasik |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | freetype 2.5.4 | Doc Type: | Bug Fix |
Doc Text: |
An integer signedness flaw, leading to a heap-based buffer overflow, was found in the way FreeType handled Mac fonts. If a specially crafted font file was loaded by an application linked against FreeType, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2015-03-18 07:40:46 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1197737, 1197738, 1197739, 1197740 | ||
Bug Blocks: | 1191102 |
Description
Vasyl Kaigorodov
2015-02-10 12:52:57 UTC
(Private) upstream bug: https://savannah.nongnu.org/bugs/?43539 Issue was fixed upstream in 2.5.4. This issue was reported as being a flaw in the boundary check added to fix CVE-2010-2808 (see bug 621907) by using negative rlen value. However, the check can not be reached with negative rlen, see: https://code.google.com/p/google-security-research/issues/detail?id=154#c6 There is another signedness issue in the part of the function that computes the amount of memory needed to store font resources. Negative resource length value can lead to insufficient buffer allocation. However, this issue is closely related to what was reported as CVE-2014-9674 (bug 1191190). The boundary between the issues, and whether they need/should to be treated as separate CVEs is not obvious. Complete upstream fix that was applied to address these two issues is noted in bug 1191190 comment 4. This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Via RHSA-2015:0696 https://rhn.redhat.com/errata/RHSA-2015-0696.html |