Red Hat Bugzilla – Full Text Bug Listing
|Summary:||CVE-2006-1861 freetype multiple integer overflows (CVE-2006-3467)|
|Product:||Red Hat Enterprise Linux 4||Reporter:||Josh Bressers <bressers>|
|Component:||freetype||Assignee:||Carl Worth <cworth>|
|Status:||CLOSED ERRATA||QA Contact:||Brock Organ <borgan>|
|Version:||4.0||CC:||eric.eisenhart, mbarnes, rstrode|
|Fixed In Version:||RHSA-2006-0500||Doc Type:||Bug Fix|
|Doc Text:||Story Points:||---|
|Last Closed:||2006-07-18 06:05:19 EDT||Type:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
Description Josh Bressers 2006-05-03 15:36:46 EDT
Several integer overflow bugs in freetype have been fixed in CVS. The details are below. The descriptions are the CVS commit messages. That patch for each particular comment is keyed off it's # identifier. * Integer overflow #2 * src/bdf/bdflib.c (ERRMSG4): New macro. (_bdf_parse_glyphs): Handle invalid BBX values. * include/freetype/fterrdef.h (FT_Err_Bbx_Too_Big): New error macro. #3 * src/sfnt/ttcmap.c (tt_face_build_cmaps): Handle invalid offset correctly. #4 * src/cff/cfftypes.h (CFF_CharsetRec): Add `max_cid' member. * src/cff/cffload.c (cff_charset_load): Set `charset->max_cid'. * src/cff/cffgload.c (cff_slot_load): Change type of third parameter to `FT_UInt'. Check range of `glyph_index'. * src/cff/cffgload.h: Updated. #6 * src/bdf/bdflib.c: fixed a problem with large encodings. Again, this patch comes from Debian libfreetype6 for 2.1.10 !
Comment 1 Josh Bressers 2006-05-03 15:41:14 EDT
Created attachment 128558 [details] Patch for issue #2
Comment 2 Josh Bressers 2006-05-03 15:41:46 EDT
Created attachment 128559 [details] Patch for issue #3
Comment 3 Josh Bressers 2006-05-03 15:42:52 EDT
Created attachment 128561 [details] Patch for issue #4
Comment 4 Josh Bressers 2006-05-03 15:43:45 EDT
Created attachment 128562 [details] Fix for issue #6
Comment 5 Josh Bressers 2006-05-03 15:48:04 EDT
These issues should also affect RHEL3 and RHEL2.1
Comment 6 Josh Bressers 2006-05-03 16:22:20 EDT
Created attachment 128565 [details] Fix for a minor DoS issue Here is a patch for a minor DoS issue as well. It doesn't have a CVE id (it may get one, but probably doesn't deserve one). Please fix it when applying the above patches.
Comment 7 Josh Bressers 2006-05-04 12:42:47 EDT
*** Bug 190693 has been marked as a duplicate of this bug. ***
Comment 8 Josh Bressers 2006-05-04 12:44:26 EDT
Bug 190693 has been marked a duplicate of this bug as it contains the patch for additional integer overflows which are covered by CVE-2006-1861. Upstream has fixed a number of potential integer overflows when allocating memory by modifying how memory is now allocated. The patch take from CVS, then clean up is very large. I don't know the source well enough to determine how much of this is needed for our packages. Attachment 128606 [details] is a patch extracted from upstream CVS
Comment 9 Matthew Barnes 2006-05-05 17:30:33 EDT
RHEL 3 and RHEL 4 packages are built, will do RHEL 2.1 next week.
Comment 10 Matthew Barnes 2006-05-10 15:19:10 EDT
RHEL 2.1 packages are built.
Comment 13 Josh Bressers 2006-05-15 13:56:31 EDT
Comment 15 Tobias Sandhaas 2006-07-17 05:16:20 EDT
I am eagerly waiting for an advisory and rpm pakets for this (and other) sever issue with freetype. Is there a reason to delay the release?
Comment 16 Mark J. Cox 2006-07-17 10:55:20 EDT
Tobias; updated packages are likely to be pushed this week this week once QA is completed. They were delayed whilst we dealt with other issues that were of a higher security severity.
Comment 17 Mark J. Cox 2006-07-18 05:37:29 EDT
Our maintainer whilst building the packages for CVE-2006-1861 noticed that the upstream patch seemed to be insufficient to correct bad1.pcf from the test suite. He corrected it. Since other vendors have already released updates we need a new CVE name for this issue, CVE-2006-3467. vendor-sec notified yesterday.
Comment 18 Red Hat Bugzilla 2006-07-18 06:05:19 EDT
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2006-0500.html