[UNIX] FreeType Integer Overflow Vulnerabilities

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



FreeType Integer Overflow Vulnerabilities
------------------------------------------------------------------------


SUMMARY

The <http://www.freetype.org> FreeType project of David Turner attempts
to create an independent implementation of the TrueType standard (as well
as other font standards). FreeType is included in many Linux distributions
and distributes with GPL compatible license.

The FreeType library has several integer overflow vulnerabilities. If a
user can be tricked into installing a specially crafted font file,
arbitrary code can be executed with the privilege of the user.

DETAILS

Vulnerable Systems:
* FreeType version 2.2 (prior versions suspected).
* FreeType version 2.1.10 (prior versions suspected).

1) An integer overflow error exists within the "read_lwfn()" function in
src/base/ftmac.c. This can potentially be exploited to cause a heap-based
buffer overflow via a specially crafted LWFN file.

2) An integer underflow error exists within the
"src/pshinter/pshglob.c:psh_blues_set_zones_0()" function when handling a
specially crafted font file where the number of blue values is odd. This
can be exploited to cause an integer underflow which corrupts the heap.

3) Integer overflow errors exist within the BDF, PCF and Type1 font file
parsers. This can potentially be exploited to cause a heap-based buffer
overflow via a specially crafted font file.


ADDITIONAL INFORMATION

The original article can be found at:
<http://secunia.com/advisories/20100/>
http://secunia.com/advisories/20100/



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NEWS] Multiple Vendor wvWare Integer Overflow Vulnerabilities (LFO, LVL)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Multiple Vendor wvWare Integer Overflow Vulnerabilities ... LFO Count Integer Overflow Vulnerability: ... reading data into the newly allocated heap buffer. ...
    (Securiteam)
  • [UNIX] Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, ... Integer Overflow) ... In order to exploit this vulnerability, an attacker simply needs to be ...
    (Securiteam)
  • [NEWS] Apple QuickTime FPX Integer Overflow
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Apple QuickTime FPX Integer Overflow ... There is an integer overflow in the way QuickTime processes fpx format ... An attacker can create an fpx file and send it to the user via ...
    (Securiteam)
  • [UNIX] PHP chunk_split() Integer Overflow
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... PHP chunk_splitInteger Overflow ... chunklen are used without any check in a memory allocation statement. ...
    (Securiteam)
  • [UNIX] Blender Integer Overflow Vulnerability (BlenLoader, get_bhead)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Remote exploitation of an integer overflow vulnerability in Blender allows ... We can manipulate with bhead.len value, because it read from blend file. ...
    (Securiteam)