Bug 491384 (CVE-2009-0946)
| Summary: | CVE-2009-0946 freetype: multiple integer overflows | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Vincent Danen <vdanen> | ||||||||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||||||||
| Status: | CLOSED ERRATA | QA Contact: | |||||||||||
| Severity: | medium | Docs Contact: | |||||||||||
| Priority: | medium | ||||||||||||
| Version: | unspecified | CC: | behdad, elliot, kreilly, kseifried, security-response-team | ||||||||||
| Target Milestone: | --- | Keywords: | Security | ||||||||||
| Target Release: | --- | ||||||||||||
| Hardware: | All | ||||||||||||
| OS: | Linux | ||||||||||||
| Whiteboard: | |||||||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||||||
| Doc Text: | Story Points: | --- | |||||||||||
| Clone Of: | Environment: | ||||||||||||
| Last Closed: | 2011-10-25 21:44:56 UTC | Type: | --- | ||||||||||
| Regression: | --- | Mount Type: | --- | ||||||||||
| Documentation: | --- | CRM: | |||||||||||
| Verified Versions: | Category: | --- | |||||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||||
| Embargoed: | |||||||||||||
| Bug Depends On: | 484441, 484442, 484443, 484444, 496111, 496112, 502577, 806287 | ||||||||||||
| Bug Blocks: | |||||||||||||
| Attachments: |
|
||||||||||||
Created attachment 336092 [details]
backported patch to 2.3.5
Created attachment 336093 [details]
backported patch to 2.2.1
Upstream commits to fix this issue: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=79972af4f0485a11dcb19551356c45245749fc5b http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=a18788b14db60ae3673f932249cd02d33a227c4e http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0a05ba257b6ddd87dacf8d54b626e4b360e0a596 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0545ec1ca36b27cb928128870a83e5f668980bc5 This issue has been assigned the CVE name CVE-2009-0946 Created attachment 339698 [details]
upstream patch from git
The upstream patch is sufficiently different from Tavis' original patch that we should backport it instead. This is a patch of the four git commits with the changelog changes removed.
CVE-2009-0946: Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c. This issue has been addressed in following products: Red Hat Enterprise Linux 2.1 Via RHSA-2009:1062 https://rhn.redhat.com/errata/RHSA-2009-1062.html This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2009:1061 https://rhn.redhat.com/errata/RHSA-2009-1061.html This issue has been addressed in following products: Red Hat Enterprise Linux 3 Red Hat Enterprise Linux 4 Via RHSA-2009:0329 https://rhn.redhat.com/errata/RHSA-2009-0329.html There is no fixed upstream version yet. Issue affects latest upstream version 2.3.9, new version with fixes from git (comment #7) has not been released yet. This was fixed upstream in 2.3.10 according to the changelog, but the site does not list this as a release to fix security issues. This still affects Fedora 10, 11, and 12. Fedora 12 has 2.3.11 in testing, which would correct the issue, but the current release is 2.3.9 for current Fedora 11 and 12, and 2.3.7 for Fedora 10. It does not look as though Fedora has been patched for this, and it really should be. Behdad, can you take care of this please? Fedora 12 currently has freetype-2.3.11-3.fc12 (FEDORA-2009-12629) so this issue has been corrected there. |
Created attachment 336091 [details] Tavis' patch for 2.3.8