[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244411

 
 

909

 
 

193363

 
 

277

Paid content will be excluded from the download.


Download | Alert*
OVAL

RHSA-2010:0737-01 -- Redhat freetype

ID: oval:org.secpod.oval:def:500347Date: (C)2012-01-31   (M)2024-02-19
Class: PATCHFamily: unix




FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently. The freetype packages for Red Hat Enterprise Linux 4 provide both the FreeType 1 and FreeType 2 font engines. The freetype packages for Red Hat Enterprise Linux 5 provide only the FreeType 2 font engine. It was discovered that the FreeType font rendering engine improperly validated certain position values when processing input streams. If a user loaded a specially-crafted font file with an application linked against FreeType, and the relevant font glyphs were subsequently rendered with the X FreeType library , it could trigger a heap-based buffer overflow in the libXft library, causing the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. A stack-based buffer overflow flaw was found in the way the FreeType font rendering engine processed some PostScript Type 1 fonts. If a user loaded a specially-crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. An array index error was found in the way the FreeType font rendering engine processed certain PostScript Type 42 font files. If a user loaded a specially-crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. A stack overflow flaw was found in the way the FreeType font rendering engine processed PostScript Type 1 font files that contain nested Standard Encoding Accented Character calls. If a user loaded a specially-crafted font file with an application linked against FreeType, it could cause the application to crash. Note: All of the issues in this erratum only affect the FreeType 2 font engine. Users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The X server must be restarted for this update to take effect.

Platform:
Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 4
Product:
freetype
Reference:
RHSA-2010:0737-01
CVE-2010-2806
CVE-2010-2808
CVE-2010-3054
CVE-2010-3311
CVE    4
CVE-2010-2808
CVE-2010-2806
CVE-2010-3311
CVE-2010-3054
...
CPE    34
cpe:/a:freetype:freetype:2.2
cpe:/a:freetype:freetype
cpe:/a:freetype:freetype:2.1.8:rc1
cpe:/a:freetype:freetype:2.3.9
...

© SecPod Technologies