Bug 645275 – CVE-2010-3855 Freetype : Heap based buffer overflow in ft_var_readpackedpoints()

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 645275 - (CVE-2010-3855) CVE-2010-3855 Freetype : Heap based buffer overflow in ft_var_readpackedpoints()

Summary:	CVE-2010-3855 Freetype : Heap based buffer overflow in ft_var_readpackedpoints()

Status:	CLOSED ERRATA

Aliases:	CVE-2010-3855

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	Unspecified Unspecified

Priority	high Severity high
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=important,source=vendor-sec,re...
Keywords:	Security

Depends On:	651757 651758 651759 651760 651761 651762 651764 806283
Blocks:
	Show dependency tree / graph

Reported:	2010-10-21 04:02 EDT by Huzaifa S. Sidhpurwala
Modified:	2015-11-24 09:35 EST (History)
CC List:	3 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-06-04 10:34:09 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
upstream patch (1.44 KB, patch) 2010-10-21 04:37 EDT, Huzaifa S. Sidhpurwala	no flags	Details \| Diff
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2010:0889	normal	SHIPPED_LIVE	Important: freetype security update	2010-11-16 11:50:34 EST

Groups: None (edit)

Description Huzaifa S. Sidhpurwala 2010-10-21 04:02:57 EDT

A heap based buffer overflow was found in the "ft_var_readpackedpoints()" function in src/truetype/ttgxvar.c when processing TrueType GX fonts.

If a user opened a specially crafted TrueType GX font file, with an application complied with freetype library, it could cause denial of service (application crash) or potentially execute arbitrary code with the privileges of the user 
running that application.

Upstream bug:
https://savannah.nongnu.org/bugs/?31310

The following commit fixes this issue:
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=59eb9f8cfe7d1df379a2318316d1f04f80fba54a

Secunia:
http://secunia.com/advisories/41738

Comment 2 Huzaifa S. Sidhpurwala 2010-10-21 04:37:26 EDT

Created attachment 454745 [details]
upstream patch

Comment 7 Huzaifa S. Sidhpurwala 2010-11-10 03:58:31 EST

Created freetype tracking bugs for this issue

Affects: fedora-all [bug 651764]

Comment 8 errata-xmlrpc 2010-11-16 11:50:47 EST

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2010:0889 https://rhn.redhat.com/errata/RHSA-2010-0889.html

Note You need to log in before you can comment on or make changes to this bug.