freetype security update

CentOS Errata and Security Advisory CESA-2006:0500

FreeType is a free, high-quality, and portable font engine.

Chris Evans discovered several integer underflow and overflow flaws in the
FreeType font engine. If a user loads a carefully crafted font file with a
program linked against FreeType, it could cause the application to crash or
execute arbitrary code as the user. While it is uncommon for a user to
explicitly load a font file, there are several application file formats
which contain embedded fonts that are parsed by FreeType. (CVE-2006-0747,
CVE-2006-1861, CVE-2006-3467)

A NULL pointer dereference flaw was found in the FreeType font engine. An
application linked against FreeType can crash upon loading a malformed font
file. (CVE-2006-2661)

Users of FreeType should upgrade to these updated packages, which contain
backported patches to correct these issues.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2006-July/075185.html
https://lists.centos.org/pipermail/centos-announce/2006-July/075188.html
https://lists.centos.org/pipermail/centos-announce/2006-July/075190.html
https://lists.centos.org/pipermail/centos-announce/2006-July/075195.html
https://lists.centos.org/pipermail/centos-announce/2006-July/075196.html
https://lists.centos.org/pipermail/centos-announce/2006-July/075204.html
https://lists.centos.org/pipermail/centos-announce/2006-July/075205.html
https://lists.centos.org/pipermail/centos-announce/2006-July/075222.html
https://lists.centos.org/pipermail/centos-announce/2006-July/075223.html

Affected packages:
freetype
freetype-demos
freetype-devel
freetype-utils

Upstream details at:
https://access.redhat.com/errata/RHSA-2006:0500