An out-of heap-based buffer read flaw was found in the way FreeType font rendering engine performed conversion of ASCII string objects, contained within glyph bitmap distribution format (BDF) font file, into signed short integers. A remote attacker could provide a specially-crafted BDF file, which once processed by an application linked against FreeType would lead to that application crash. Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35658 Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=d9c1659610f9cd5e103790cb5963483d65cf0d2d Acknowledgements: Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
Added CVE as per http://www.openwall.com/lists/oss-security/2012/03/06/16
This issue affects the versions of the freetype package, as shipped with Red Hat Enterprise Linux 5 and 6. -- This issue affects the versions of the freetype package, as shipped with Fedora release of 15 and 16.
(In reply to comment #0) > Upstream patch: > http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=d9c1659610f9cd5e103790cb5963483d65cf0d2d Updated / extended in: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=649c673a8fc1795536c5b9a48503568d9e2a75c6 See upstream bug for details.
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 Via RHSA-2012:0467 https://rhn.redhat.com/errata/RHSA-2012-0467.html