Bug 2081599 (CVE-2022-27470) - CVE-2022-27470 sdf_ttf: Arbitrary memory overwrite occurs when loading glyphs and rendering text with a malformed TTF file
Summary: CVE-2022-27470 sdf_ttf: Arbitrary memory overwrite occurs when loading glyphs...
Keywords:
Status: CLOSED UPSTREAM
Alias: CVE-2022-27470
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2081600 2081602 2081603 2081604 2081605 2081606
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-05-04 07:33 UTC by Avinash Hanwate
Modified: 2022-05-04 11:45 UTC (History)
9 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2022-05-04 11:45:28 UTC
Embargoed:

Attachments (Terms of Use)

Description Avinash Hanwate 2022-05-04 07:33:52 UTC 
SDL_ttf v2.0.18 and below was discovered to contain an arbitrary memory write via the function TTF_RenderText_Solid(). This vulnerability is triggered via a crafted TTF file.

https://github.com/libsdl-org/SDL_ttf/commit/db1b41ab8bde6723c24b866e466cad78c2fa0448
https://github.com/libsdl-org/SDL_ttf/issues/187
Comment 1 Avinash Hanwate 2022-05-04 07:34:48 UTC 
Created SDL2_ttf tracking bugs for this issue:

Affects: epel-all [bug 2081600]
Affects: fedora-all [bug 2081606]


Created SDL_ttf tracking bugs for this issue:

Affects: epel-all [bug 2081602]
Affects: fedora-all [bug 2081605]


Created mingw-SDL2_ttf tracking bugs for this issue:

Affects: fedora-all [bug 2081603]


Created mingw-SDL_ttf tracking bugs for this issue:

Affects: fedora-all [bug 2081604]
Comment 2 Artur Frenszek-Iwicki 2022-05-04 08:13:01 UTC 
SDL_ttf underwent a major rewrite between v2.0.11 and v2.0.12, since the former is meant to work with SDL v1.2, whereas the latter is for SDL v2.x.
Upstream commits fixing the CVE do not apply to v2.0.11 code. We'd need to perform some investigation to check if this actually affects v2.0.11.
Comment 3 Product Security DevOps Team 2022-05-04 11:45:26 UTC 
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.
Note You need to log in before you can comment on or make changes to this bug.