Bug 450768 (CVE-2008-1806)

Summary: CVE-2008-1806 FreeType PFB integer overflow
Product: [Other] Security Response Reporter: Josh Bressers <bressers>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: behdad, kreilly
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=715
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-07-21 09:32:11 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 450905, 450906, 450908, 450909, 450910, 450911, 451212, 451213, 806288    
Bug Blocks:    
Attachments:
Description Flags
Patch extracted from upstream none

Description Josh Bressers 2008-06-10 20:55:46 UTC
An integer overflow flaw was found in FreeType's PFB processor.

According to the advisory:
    The vulnerability exists within the code responsible for parsing Printer Font
    Binary (PFB) format font files. PFB files contain a section known as the 
    "Private" dictionary table which is used to describe how characters are 
    constructed. When parsing this data structure, a series of 16-bit length 
    values are read in from the file. These values are added together and used to 
    allocate a dynamic buffer. The addition can result in an integer overflow, 
    which subsequently leads to a heap overflow.

Comment 1 Josh Bressers 2008-06-11 17:21:06 UTC
Created attachment 308965 [details]
Patch extracted from upstream

This patch contains the fixes for CVE-2008-1806, CVE-2008-1807, and
CVE-2008-1808

Comment 5 Tomas Hoger 2008-06-13 13:57:22 UTC
Parts of the patch (seems to be TTF part of the CVE-2008-1808) also seem to
apply to freetype1 shipped in Fedora.  freetype1 only seems to be used by
MagicPoint, which probably does not load arbitrary font files.

Comment 8 Fedora Update System 2008-06-17 09:43:47 UTC
freetype-2.3.5-4.fc8 has been submitted as an update for Fedora 8

Comment 9 Fedora Update System 2008-06-17 09:44:14 UTC
freetype-2.3.5-6.fc9 has been submitted as an update for Fedora 9

Comment 10 Fedora Update System 2008-06-18 03:15:09 UTC
freetype-2.3.5-6.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2008-06-18 03:15:39 UTC
freetype-2.3.5-4.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.