Bug 2081599 (CVE-2022-27470)

Summary:	CVE-2022-27470 sdf_ttf: Arbitrary memory overwrite occurs when loading glyphs and rendering text with a malformed TTF file
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	fedora, gwync, hdegoede, igor.raits, moez.roy, sebastian, spotrh, thomasj, walter.pete
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-04 11:45:28 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2081600, 2081602, 2081603, 2081604, 2081605, 2081606
Bug Blocks:

Description Avinash Hanwate 2022-05-04 07:33:52 UTC

SDL_ttf v2.0.18 and below was discovered to contain an arbitrary memory write via the function TTF_RenderText_Solid(). This vulnerability is triggered via a crafted TTF file.

https://github.com/libsdl-org/SDL_ttf/commit/db1b41ab8bde6723c24b866e466cad78c2fa0448
https://github.com/libsdl-org/SDL_ttf/issues/187

Comment 1 Avinash Hanwate 2022-05-04 07:34:48 UTC

Created SDL2_ttf tracking bugs for this issue:

Affects: epel-all [bug 2081600]
Affects: fedora-all [bug 2081606]


Created SDL_ttf tracking bugs for this issue:

Affects: epel-all [bug 2081602]
Affects: fedora-all [bug 2081605]


Created mingw-SDL2_ttf tracking bugs for this issue:

Affects: fedora-all [bug 2081603]


Created mingw-SDL_ttf tracking bugs for this issue:

Affects: fedora-all [bug 2081604]

Comment 2 Artur Frenszek-Iwicki 2022-05-04 08:13:01 UTC

SDL_ttf underwent a major rewrite between v2.0.11 and v2.0.12, since the former is meant to work with SDL v1.2, whereas the latter is for SDL v2.x.
Upstream commits fixing the CVE do not apply to v2.0.11 code. We'd need to perform some investigation to check if this actually affects v2.0.11.

Comment 3 Product Security DevOps Team 2022-05-04 11:45:26 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.