Bug 491384 (CVE-2009-0946)

Summary: CVE-2009-0946 freetype: multiple integer overflows
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: behdad, elliot, kreilly, kseifried, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-10-25 21:44:56 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 484441, 484442, 484443, 484444, 496111, 496112, 502577, 806287    
Bug Blocks:    
Description Flags
Tavis' patch for 2.3.8
backported patch to 2.3.5
backported patch to 2.2.1
upstream patch from git none

Comment 2 Vincent Danen 2009-03-20 17:58:03 UTC
Created attachment 336091 [details]
Tavis' patch for 2.3.8

Comment 3 Vincent Danen 2009-03-20 17:59:18 UTC
Created attachment 336092 [details]
backported patch to 2.3.5

Comment 4 Vincent Danen 2009-03-20 17:59:43 UTC
Created attachment 336093 [details]
backported patch to 2.2.1

Comment 8 Vincent Danen 2009-04-15 04:19:59 UTC
This issue has been assigned the CVE name CVE-2009-0946

Comment 9 Vincent Danen 2009-04-15 15:24:52 UTC
Created attachment 339698 [details]
upstream patch from git

The upstream patch is sufficiently different from Tavis' original patch that we should backport it instead.  This is a patch of the four git commits with the changelog changes removed.

Comment 13 Tomas Hoger 2009-04-17 06:53:13 UTC
Multiple integer overflows in FreeType 2.3.9 and earlier allow remote
attackers to execute arbitrary code via vectors related to large
values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c,
and (3) cff/cffload.c.

Comment 15 errata-xmlrpc 2009-05-22 12:06:30 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 2.1

Via RHSA-2009:1062 https://rhn.redhat.com/errata/RHSA-2009-1062.html

Comment 16 errata-xmlrpc 2009-05-22 12:12:03 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1061 https://rhn.redhat.com/errata/RHSA-2009-1061.html

Comment 17 errata-xmlrpc 2009-05-22 12:22:16 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 3
  Red Hat Enterprise Linux 4

Via RHSA-2009:0329 https://rhn.redhat.com/errata/RHSA-2009-0329.html

Comment 18 Tomas Hoger 2009-05-26 08:39:31 UTC
There is no fixed upstream version yet.  Issue affects latest upstream version 2.3.9, new version with fixes from git (comment #7) has not been released yet.

Comment 20 Vincent Danen 2009-12-04 19:19:26 UTC
This was fixed upstream in 2.3.10 according to the changelog, but the site does not list this as a release to fix security issues.

This still affects Fedora 10, 11, and 12.  Fedora 12 has 2.3.11 in testing, which would correct the issue, but the current release is 2.3.9 for current Fedora 11 and 12, and 2.3.7 for Fedora 10.

It does not look as though Fedora has been patched for this, and it really should be.  Behdad, can you take care of this please?

Comment 23 Vincent Danen 2009-12-10 15:50:49 UTC
Fedora 12 currently has freetype-2.3.11-3.fc12 (FEDORA-2009-12629) so this issue has been corrected there.