Bug 190593 - CVE-2006-1861 freetype multiple integer overflows (CVE-2006-3467)
CVE-2006-1861 freetype multiple integer overflows (CVE-2006-3467)
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: freetype (Show other bugs)
4.0
All Linux
high Severity high
: ---
: ---
Assigned To: Carl Worth
Brock Organ
source=vendorsec,reported=20060305,im...
: Security
: 190693 (view as bug list)
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2006-05-03 15:36 EDT by Josh Bressers
Modified: 2007-11-30 17:07 EST (History)
3 users (show)

See Also:
Fixed In Version: RHSA-2006-0500
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-07-18 06:05:19 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Patch for issue #2 (2.70 KB, patch)
2006-05-03 15:41 EDT, Josh Bressers
no flags Details | Diff
Patch for issue #3 (908 bytes, patch)
2006-05-03 15:41 EDT, Josh Bressers
no flags Details | Diff
Patch for issue #4 (4.38 KB, patch)
2006-05-03 15:42 EDT, Josh Bressers
no flags Details | Diff
Fix for issue #6 (1.19 KB, patch)
2006-05-03 15:43 EDT, Josh Bressers
no flags Details | Diff
Fix for a minor DoS issue (897 bytes, patch)
2006-05-03 16:22 EDT, Josh Bressers
no flags Details | Diff

  None (edit)
Description Josh Bressers 2006-05-03 15:36:46 EDT
Several integer overflow bugs in freetype have been fixed in CVS.  The details
are below.

The descriptions are the CVS commit messages.  That patch for each particular
comment is keyed off it's # identifier.

* Integer overflow

    #2
    * src/bdf/bdflib.c (ERRMSG4): New macro.
      (_bdf_parse_glyphs): Handle invalid BBX values.
    * include/freetype/fterrdef.h (FT_Err_Bbx_Too_Big): New error
      macro.

    #3
    * src/sfnt/ttcmap.c (tt_face_build_cmaps): Handle invalid offset
    correctly.

    #4
    * src/cff/cfftypes.h (CFF_CharsetRec): Add `max_cid' member.
    * src/cff/cffload.c (cff_charset_load): Set `charset->max_cid'.
    * src/cff/cffgload.c (cff_slot_load): Change type of third parameter
    to `FT_UInt'.
    Check range of `glyph_index'.
    * src/cff/cffgload.h: Updated.

    #6
    * src/bdf/bdflib.c: fixed a problem with large encodings.
    Again, this patch comes from Debian libfreetype6 for 2.1.10 !
Comment 1 Josh Bressers 2006-05-03 15:41:14 EDT
Created attachment 128558 [details]
Patch for issue #2
Comment 2 Josh Bressers 2006-05-03 15:41:46 EDT
Created attachment 128559 [details]
Patch for issue #3
Comment 3 Josh Bressers 2006-05-03 15:42:52 EDT
Created attachment 128561 [details]
Patch for issue #4
Comment 4 Josh Bressers 2006-05-03 15:43:45 EDT
Created attachment 128562 [details]
Fix for issue #6
Comment 5 Josh Bressers 2006-05-03 15:48:04 EDT
These issues should also affect RHEL3 and RHEL2.1
Comment 6 Josh Bressers 2006-05-03 16:22:20 EDT
Created attachment 128565 [details]
Fix for a minor DoS issue

Here is a patch for a minor DoS issue as well.	It doesn't have a CVE id (it
may get one, but probably doesn't deserve one).  Please fix it when applying
the above patches.
Comment 7 Josh Bressers 2006-05-04 12:42:47 EDT
*** Bug 190693 has been marked as a duplicate of this bug. ***
Comment 8 Josh Bressers 2006-05-04 12:44:26 EDT
Bug 190693 has been marked a duplicate of this bug as it contains the patch for
additional integer overflows which are covered by CVE-2006-1861.



Upstream has fixed a number of potential integer overflows when allocating
memory by modifying how memory is now allocated.

The patch take from CVS, then clean up is very large.  I don't know the source
well enough to determine how much of this is needed for our packages.

Attachment 128606 [details] is a patch extracted from upstream CVS
Comment 9 Matthew Barnes 2006-05-05 17:30:33 EDT
RHEL 3 and RHEL 4 packages are built, will do RHEL 2.1 next week.
Comment 10 Matthew Barnes 2006-05-10 15:19:10 EDT
RHEL 2.1 packages are built.
Comment 13 Josh Bressers 2006-05-15 13:56:31 EDT
Lifting embargo
Comment 15 Tobias Sandhaas 2006-07-17 05:16:20 EDT
I am eagerly waiting for an advisory and rpm pakets for this (and other) sever
issue with freetype.
Is there a reason to delay the release?
Comment 16 Mark J. Cox (Product Security) 2006-07-17 10:55:20 EDT
Tobias; updated packages are likely to be pushed this week this week once QA is
completed.  They were delayed whilst we dealt with other issues that were of a
higher security severity.  
Comment 17 Mark J. Cox (Product Security) 2006-07-18 05:37:29 EDT
Our maintainer whilst building the packages for CVE-2006-1861 noticed that the
upstream patch seemed to be insufficient to correct bad1.pcf from the test
suite.  He corrected it.  Since other vendors have already released updates we
need a new CVE name for this issue, CVE-2006-3467.  vendor-sec notified yesterday.
Comment 18 Red Hat Bugzilla 2006-07-18 06:05:19 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2006-0500.html

Note You need to log in before you can comment on or make changes to this bug.