Red Hat Bugzilla – Bug 1191087
CVE-2014-9665 freetype: integer overflow leading to heap-based buffer overflow in Load_SBit_Png()
Last modified: 2015-02-20 18:12:59 EST
Common Vulnerabilities and Exposures assigned CVE-2014-9665 to the following issue: The Load_SBit_Png function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact by embedding a PNG file in a .ttf font file. http://code.google.com/p/google-security-research/issues/detail?id=168 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=54abd22891bd51ef8b533b24df53b3019b5cee81 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=b3500af717010137046ec4076d1e1c0641e33727
Created freetype tracking bugs for this issue: Affects: fedora-all [bug 1191099]
freetype-2.5.3-15.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
freetype-2.5.0-9.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
Upstream bug is: https://savannah.nongnu.org/bugs/?43658 Issue was fixed upstream in 2.5.4. Support for bitmaps embedded in SFNT fonts was introduced in upstream version 2.5. Additionally, the affected code was added in 2.5.1 via: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=01705395 The freetype packages in Red Hat Enterprise Linux 7 and earlier are based on older unaffected upstream versions. Statement: Not vulnerable. This issue did not affect the versions of freetype as shipped with Red Hat Enterprise Linux 5, 6 and 7.