[OpenPKG-SA-2007.018] OpenPKG Security Advisory (freetype)



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

____________________________________________________________________________

Publisher Name: OpenPKG GmbH
Publisher Home: http://openpkg.com/

Advisory Id (public): OpenPKG-SA-2007.018
Advisory Type: OpenPKG Security Advisory (SA)
Advisory Directory: http://openpkg.com/go/OpenPKG-SA
Advisory Document: http://openpkg.com/go/OpenPKG-SA-2007.018
Advisory Published: 2007-05-24 10:32 UTC

Issue Id (internal): OpenPKG-SI-20070524.01
Issue First Created: 2007-05-24
Issue Last Modified: 2007-05-24
Issue Revision: 04
____________________________________________________________________________

Subject Name: freetype
Subject Summary: TrueType Font (TTF) Rendering Library
Subject Home: http://freetype.sourceforge.net/
Subject Versions: * >= 2.3.4

Vulnerability Id: CVE-2007-2754
Vulnerability Scope: global (not OpenPKG specific)

Attack Feasibility: run-time
Attack Vector: remote network
Attack Impact: arbitrary code execution

Description:
A vulnerability caused by an integer signedness error was found
[0] by Victor Stinner in the font rendering library Freetype [1],
versions up to and including 2.3.4. The vulnerability might allow
remote attackers to execute arbitrary code via a specially crafted
TrueType Font (TTF) file with a negative "n_points" value, which
leads to an integer overflow and heap-based buffer overflow [2].

Advisory-References:
[0] http://lists.gnu.org/archive/html/freetype-devel/2007-04/msg00041.html
[1] http://freetype.sourceforge.net/
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2754

References:

____________________________________________________________________________

Primary Package Name: freetype
Primary Package Home: http://openpkg.org/go/package/freetype

Corrected Distribution: Corrected Branch: Corrected Package:
OpenPKG Enterprise E1.0-SOLID freetype-2.2.1-E1.0.1
OpenPKG Community CURRENT freetype-2.3.4-20070524
____________________________________________________________________________

For security reasons, this document was digitally signed with the
OpenPGP public key of the OpenPKG GmbH (public key id 61B7AE34)
which you can download from http://openpkg.com/openpkg.com.pgp
or retrieve from the OpenPGP keyserver at hkp://pgp.openpkg.org/.
Follow the instructions at http://openpkg.com/security/signatures/
for more details on how to verify the integrity of this document.
____________________________________________________________________________

-----BEGIN PGP SIGNATURE-----
Comment: OpenPKG GmbH <http://openpkg.com/>

iD8DBQFGVU2sZwQuyWG3rjQRAhl4AKDAxlf6Lgl4ETSnF88H8+WLSj7pIQCeNp/5
UwNC7YG01KEsrk4aVQsASkk=
=RPNY
-----END PGP SIGNATURE-----



Relevant Pages

  • [NT] CitectSCADA ODBC Service Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... are distributed in over 80 countries through a network of more than 500 ... A vulnerability was found in CitectSCADA that could allow a remote ...
    (Securiteam)
  • [OpenPKG-SA-2007.013] OpenPKG Security Advisory (png)
    ... Advisory Id: OpenPKG-SA-2007.013 ... a Denial of Service vulnerability ... Primary Package Home: http://openpkg.org/go/package/png ... OpenPGP public key of the OpenPKG GmbH ...
    (Bugtraq)
  • Re: [Full-disclosure] Full-Disclosure Digest, Vol 79, Issue 21
    ... See MS advisory for full list of affected products. ... Seeker Research Center Security Advisory ... This vulnerability was discovered by Seeker? ... The request also contains other parameters required by the page, the vulnerable parameter being the parameter noted above. ...
    (Full-Disclosure)
  • [Full-disclosure] [OpenPKG-SA-2007.022] OpenPKG Security Advisory (bind)
    ... Advisory Id: OpenPKG-SA-2007.022 ... Vulnerability Scope: global ... If not set anyone can make recursive queries and/or query the ... Primary Package Home: http://openpkg.org/go/package/bind ...
    (Full-Disclosure)
  • [NT] Microsoft Word Malformed FIB Arbitrary Free Vulnerability (MS08-072)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A vulnerability has been found in the way that Microsoft Word handles ... Vendor Information, Solutions and Workarounds: ... Core requests information concerning Microsoft's plans to fix ...
    (Securiteam)