Bug 1191096 – CVE-2014-9673 freetype: integer signedness error in Mac_Read_POST_Resource() leading to heap-based buffer overflow

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1191096 - (CVE-2014-9673) CVE-2014-9673 freetype: integer signedness error in Mac_Read_POST_Resource() leading to heap-based buffer overflow

Summary:	CVE-2014-9673 freetype: integer signedness error in Mac_Read_POST_Resource() ...

Status:	CLOSED ERRATA

Aliases:	CVE-2014-9673

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	high Severity high
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=important,public=20141124,repo...
Keywords:	Security

Depends On:	1197737 1197738 1197739 1197740
Blocks:	1191102
	Show dependency tree / graph

Reported:	2015-02-10 07:52 EST by Vasyl Kaigorodov
Modified:	2015-11-25 05:29 EST (History)
CC List:	4 users (show)

See Also:
Fixed In Version:	freetype 2.5.4
Doc Type:	Bug Fix
Doc Text:	An integer signedness flaw, leading to a heap-based buffer overflow, was found in the way FreeType handled Mac fonts. If a specially crafted font file was loaded by an application linked against FreeType, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-03-18 03:40:46 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2015:0696	normal	SHIPPED_LIVE	Important: freetype security update	2015-03-17 17:58:07 EDT

Groups: None (edit)

Description Vasyl Kaigorodov 2015-02-10 07:52:57 EST

Common Vulnerabilities and Exposures assigned CVE-2014-9673 to the following issue:

Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c
in FreeType before 2.5.4 allows remote attackers to cause a denial of service
(heap-based buffer overflow) or possibly have unspecified other impact via a
crafted Mac font.

http://code.google.com/p/google-security-research/issues/detail?id=154
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=35252ae9aa1dd9343e9f4884e9ddb1fee10ef415

Comment 1 Tomas Hoger 2015-02-24 15:58:36 EST

(Private) upstream bug:
https://savannah.nongnu.org/bugs/?43539

Issue was fixed upstream in 2.5.4.

This issue was reported as being a flaw in the boundary check added to fix CVE-2010-2808 (see bug 621907) by using negative rlen value.  However, the check can not be reached with negative rlen, see:

https://code.google.com/p/google-security-research/issues/detail?id=154#c6

There is another signedness issue in the part of the function that computes the amount of memory needed to store font resources.  Negative resource length value can lead to insufficient buffer allocation.  However, this issue is closely related to what was reported as CVE-2014-9674 (bug 1191190).  The boundary between the issues, and whether they need/should to be treated as separate CVEs is not obvious.

Complete upstream fix that was applied to address these two issues is noted in bug 1191190 comment 4.

Comment 4 errata-xmlrpc 2015-03-17 13:59:16 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2015:0696 https://rhn.redhat.com/errata/RHSA-2015-0696.html

Note You need to log in before you can comment on or make changes to this bug.