freetype security update

2007-04-1612:48:19

CentOS Project

lists.centos.org

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

EPSS

0.05

Percentile

92.9%

JSON

CentOS Errata and Security Advisory CESA-2007:0150

FreeType is a free, high-quality, portable font engine.

An integer overflow flaw was found in the way the FreeType font engine
processed BDF font files. If a user loaded a carefully crafted font file
with a program linked against FreeType, it could cause the application to
crash or execute arbitrary code. While it is uncommon for a user to
explicitly load a font file, there are several application file formats
which contain embedded fonts that are parsed by FreeType. (CVE-2007-1351)

This flaw did not affect the version of FreeType shipped in Red Hat
Enterprise Linux 2.1.

Users of FreeType should upgrade to these updated packages, which contain
a backported patch to correct this issue.

Red Hat would like to thank iDefense for reporting this issue.

Affected packages:
freetype
freetype-demos
freetype-devel
freetype-utils

Upstream details at:
https://access.redhat.com/errata/RHSA-2007:0150

OSVersionArchitecturePackageVersionFilename
CentOS3i386freetype< 2.1.4-6.el3freetype-2.1.4-6.el3.i386.rpm
CentOS3i386freetype-demos< 2.1.4-6.el3freetype-demos-2.1.4-6.el3.i386.rpm
CentOS3i386freetype-devel< 2.1.4-6.el3freetype-devel-2.1.4-6.el3.i386.rpm
CentOS3i386freetype-utils< 2.1.4-6.el3freetype-utils-2.1.4-6.el3.i386.rpm
CentOS3i386freetype< 2.1.4-6.el3freetype-2.1.4-6.el3.i386.rpm
CentOS3x86_64freetype< 2.1.4-6.el3freetype-2.1.4-6.el3.x86_64.rpm
CentOS3x86_64freetype-demos< 2.1.4-6.el3freetype-demos-2.1.4-6.el3.x86_64.rpm
CentOS3x86_64freetype-devel< 2.1.4-6.el3freetype-devel-2.1.4-6.el3.x86_64.rpm
CentOS3x86_64freetype-utils< 2.1.4-6.el3freetype-utils-2.1.4-6.el3.x86_64.rpm
CentOS3ia64freetype< 2.1.4-6.el3freetype-2.1.4-6.el3.ia64.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	3	i386	freetype	< 2.1.4-6.el3	freetype-2.1.4-6.el3.i386.rpm
CentOS	3	i386	freetype-demos	< 2.1.4-6.el3	freetype-demos-2.1.4-6.el3.i386.rpm
CentOS	3	i386	freetype-devel	< 2.1.4-6.el3	freetype-devel-2.1.4-6.el3.i386.rpm
CentOS	3	i386	freetype-utils	< 2.1.4-6.el3	freetype-utils-2.1.4-6.el3.i386.rpm
CentOS	3	i386	freetype	< 2.1.4-6.el3	freetype-2.1.4-6.el3.i386.rpm
CentOS	3	x86_64	freetype	< 2.1.4-6.el3	freetype-2.1.4-6.el3.x86_64.rpm
CentOS	3	x86_64	freetype-demos	< 2.1.4-6.el3	freetype-demos-2.1.4-6.el3.x86_64.rpm
CentOS	3	x86_64	freetype-devel	< 2.1.4-6.el3	freetype-devel-2.1.4-6.el3.x86_64.rpm
CentOS	3	x86_64	freetype-utils	< 2.1.4-6.el3	freetype-utils-2.1.4-6.el3.x86_64.rpm
CentOS	3	ia64	freetype	< 2.1.4-6.el3	freetype-2.1.4-6.el3.ia64.rpm