Debian DLA-2415-1 : freetype security update

Sergei Glazunov discovered a heap-based buffer overflow vulnerability in the handling of embedded PNG bitmaps in FreeType. Opening malformed fonts may result in denial of service or the execution of arbitrary code. For Debian 9 stretch, this problem has been fixed in version 2.6.3-3.2+deb9u2. We...

Debian: Security Advisory (DLA-2415-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2415-1] freetype security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2415-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz October 25, 2020 https://wiki.debian.org/LTS -...

Security update for freetype2 (important)

openSUSE Security Update: Security update for freetype2 Announcement ID: openSUSE-SU-2020:1734-1 Rating: important References: 1177914 Cross-References: CVE-2020-15999 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for...

FreeBSD : freetype2 -- heap buffer overlfow (458df97f-1440-11eb-aaec-e0d55e2a8bf9)

The freetype project reports : A heap buffer overflow has been found in the handling of embedded PNG bitmaps, introduced in FreeType version 2.6. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright...

GLSA-202010-07 : FreeType: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-202010-07 FreeType: Arbitrary code execution A flaw in FreeTypes handling of embedded PNG bitmaps was discovered where the image height and width was not checked to be within bounds. Impact : A remote attacker could entice a user ...

Debian DSA-4777-1 : freetype - security update

Sergei Glazunov discovered a heap-based buffer overflow vulnerability in the handling of embedded PNG bitmaps in FreeType. Opening malformed fonts may result in denial of service or the execution of arbitrary code. C Tenable Network Security, Inc. The descriptive text and package checks in this...

SUSE-SU-2020:2998-1 Security update for freetype2

This update for freetype2 fixes the following issues: - CVE-2020-15999: fixed a heap buffer overflow found in the handling of embedded PNG bitmaps bsc1177914...

freetype2 -- heap buffer overlfow

The freetype project reports: A heap buffer overflow has been found in the handling of embedded PNG bitmaps, introduced in FreeType version 2.6...

SUSE SLED15 / SLES15 Security Update : java-11-openjdk (SUSE-SU-2020:2143-1)

This update for java-11-openjdk fixes the following issues : Update to upstream tag jdk-11.0.8+10 July 2020 CPU, bsc1174157 - Security fixes : + JDK-8230613: Better ASCII conversions + JDK-8231800: Better listing of arrays + JDK-8232014: Expand DTD support + JDK-8233234: Better Zip Naming +...

Product update: Virtuozzo Hybrid Server 7.0 Update 14 Hotfix 1 (7.0.14-257)

The Hotfix 1 for Virtuozzo Hybrid Server 7.0 Update 14 provides stability and usability bug fixes. Vulnerability id: PSBM-105022 Unable to live-migrate VMs with dirty bitmaps on Virtuozzo Storage. Vulnerability id: PSBM-104631, PSBM-104632 CS journals to be placed on SSDs are now properly handled...

Memory Corruption Vulnerability in MicroDicom viewer

MicroDicom viewer is a very comprehensive medical image viewing tool. MicroDicom viewer suffers from a memory corruption vulnerability that can be exploited to crash the program by constructing malformed BMP images...

Product update: Virtuozzo 7.0 Update 13 (7.0.13-298)

The Update 13 for Virtuozzo 7.0 introduces new features and provides stability and usability bug fixes. It also introduces a new kernel 3.10.0-1062.12.1.vz7.131.10. Vulnerability id: PSBM-95072 'pstorage-target' files are left over after successful migrations of VMs on Virtuozzo Storage from...

Product update: Virtuozzo 7.0 Update 12 Hotfix 1 (7.0.12-338)

The Hotfix 1 for Virtuozzo 7.0 Update 12 provides stability and usability bug fixes. It also introduces a new kernel 3.10.0-1062.4.2.vz7.116.7. Vulnerability id: PSBM-100079, PSBM-100093 VMs with inconsistent bitmaps could not be migrated. Vulnerability id: PSBM-100158 Kernel memory leak on VM st...

SUSE SLES12 Security Update : xen (SUSE-SU-2019:3297-1)

This update for xen fixes the following issues : CVE-2019-19581: Fixed a potential out of bounds on 32-bit Arm bsc1158003 XSA-307. CVE-2019-19582: Fixed a potential infinite loop when x86 accesses to bitmaps with a compile time known size of 64 bsc1158003 XSA-307. CVE-2019-19583: Fixed improper...

Design/Logic Flaw

An issue was discovered in Xen through 4.12.x allowing x86 guest OS users to cause a denial of service infinite loop because certain bit iteration is mishandled. In a number of places bitmaps are being used by the hypervisor to track certain state. Iteration over all bits involves functions which...

CVE-2019-19581

An issue was discovered in Xen through 4.12.x allowing 32-bit Arm guest OS users to cause a denial of service out-of-bounds access because certain bit iteration is mishandled. In a number of places bitmaps are being used by the hypervisor to track certain state. Iteration over all bits involves...

find_next_bit() issues

ISSUE DESCRIPTION In a number of places bitmaps are being used by the hypervisor to track certain state. Iteration over all bits involves functions which may misbehave in certain corner cases: - On 32-bit Arm accesses to bitmaps with bit a count which is a multiple of 32, an out of bounds access...

freetype2:glyphs-bitmaps-pcf: Heap-buffer-overflow in triplet_decode

Detailed Report: https://oss-fuzz.com/testcase?key=5687246878932992 Project: freetype2 Fuzzing Engine: libFuzzer Fuzz Target: glyphs-bitmaps-pcf Job Type: libfuzzerasanfreetype2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x61d00000096f Crash State: tripletdecode...

Ubuntu 18.04 LTS : FreeRDP vulnerabilities (USN-3845-2)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3845-2 advisory. USN-3845-1 fixed several vulnerabilities in FreeRDP. This update provides the corresponding update for Ubuntu 18.04 LTS and Ubuntu 18.10. Tenable has...