Bug 487070 (CVE-2006-3467)

Summary:	CVE-2006-3467 freetype: integer overflow vulnerability due to incomplete fix for CVE-2006-1861
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ajax, fonts-bugs
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-3467
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-12-22 16:28:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Vincent Danen 2009-02-23 23:53:07 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2006-3467 to the following vulnerability:

Name: CVE-2006-3467
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3467
Assigned: 20060710
Reference: URL: http://www.securityfocus.com/archive/1/archive/1/451426/100/200/threaded
Reference: MISC: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=190593

Integer overflow in FreeType before 2.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PCF file, as demonstrated by the Red Hat
bad1.pcf test file, due to a partial fix of CVE-2006-1861.

Comment 2 Vincent Danen 2010-12-22 16:28:19 UTC

This was addressed via:

Red Hat Enterprise Linux version 2.1 (RHSA-2006:0500 (freetype)	and RHSA-2006:0635 (XFree86))
Red Hat Enterprise Linux version 3 (RHSA-2006:0500 (freetype) and RHSA-2006:0635 (XFree86))
Red Hat Enterprise Linux version 4 (RHSA-2006:0500 (freetype) and RHSA-2006:0634 (xorg-x11))