This update of freetype2 fixes several vulnerabilities that could lead to remote system compromise by executing arbitrary code with user privileges :

  - stack-based buffer overflow while processing CFF     opcodes. (CVE-2010-1797)

  - integer underflow. (CVE-2010-2497)

  - invalid free. (CVE-2010-2498)

  - buffer overflow. (CVE-2010-2499)

  - integer overflow. (CVE-2010-2500)

  - heap buffer overflow. (CVE-2010-2519)

  - heap buffer overflow. (CVE-2010-2520)

  - buffer overflows in the freetype demo. (CVE-2010-2527)

  - buffer overflow in ftmulti demo program. (CVE-2010-2541)

  - improper bounds checking. (CVE-2010-2805)

  - improper bounds checking. (CVE-2010-2806)

  - improper type comparisons. (CVE-2010-2807)

  - memory corruption flaw by processing certain LWFN fonts.
    (CVE-2010-2808)

This update of freetype2 fixes several vulnerabilities that could lead to remote system compromise by executing arbitrary code with user privileges :

  - CVE-2010-1797: stack-based buffer overflow while     processing CFF opcodes

  - CVE-2010-2497: integer underflow

  - CVE-2010-2498: invalid free

  - CVE-2010-2499: buffer overflow

  - CVE-2010-2500: integer overflow

  - CVE-2010-2519: heap buffer overflow

  - CVE-2010-2520: heap buffer overflow

  - CVE-2010-2527: buffer overflows in the freetype demo

  - CVE-2010-2541: buffer overflow in ftmulti demo program

  - CVE-2010-2805: improper bounds checking

  - CVE-2010-2806: improper bounds checking

  - CVE-2010-2807: improper type comparisons

  - CVE-2010-2808: memory corruption flaw by processing     certain LWFN fonts

It was found that the FreeType font rendering engine improperly validated certain position values when processing input streams. If a user loaded a specially crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-2805, CVE-2010-3311)

A stack-based buffer overflow flaw was found in the way the FreeType font rendering engine processed some PostScript Type 1 fonts. If a user loaded a specially crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-2808)

An array index error was found in the way the FreeType font rendering engine processed certain PostScript Type 42 font files. If a user loaded a specially crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-2806)

Note: All of the issues in this erratum only affect the FreeType 2 font engine.

The X server must be restarted (log out, then log back in) for this update to take effect.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2010-460:03 advisory.

    The FreeType engine is a free and portable TrueType font rendering engine, developed to provide TrueType     support for a variety of platforms and environments. FreeType is a library which can open and manages font     files as well as efficiently load, hint and render individual glyphs. FreeType is not a font server or a     complete text-rendering library.
    Security issues fixed with this release:
    CVE-2010-2806     Array index error in the t42_parse_sfnts function in type42/t42parse.c in FreeType before 2.4.2 allows     remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via     negative size values for certain strings in FontType42 font files, leading to a heap-based buffer     overflow.
    CVE-2010-2808     Buffer overflow in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.4.2 allows     remote attackers to cause a denial of service (memory corruption and application crash) or possibly     execute arbitrary code via a crafted Adobe Type 1 Mac Font File (aka LWFN) font.
    CVE-2010-3054     Unspecified vulnerability in FreeType 2.3.9, and other versions before 2.4.2, allows remote attackers to     cause a denial of service via vectors involving nested Standard Encoding Accented Character (aka seac)     calls, related to psaux.h, cffgload.c, cffgload.h, and t1decode.c.
    CVE-2010-3311     No information available at the time of writing, see the CVE link below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.5.

Mac OS X 10.6.5 contains security fixes for the following products :

  - AFP Server
  - Apache mod_perl
  - Apache
  - AppKit
  - ATS
  - CFNetwork
  - CoreGraphics
  - CoreText
  - CUPS
  - Directory Services
  - diskdev_cmds
  - Disk Images
  - Flash Player plug-in
  - gzip
  - Image Capture
  - ImageIO
  - Image RAW
  - Kernel
  - MySQL
  - neon
  - Networking
  - OpenLDAP
  - OpenSSL
  - Password Server
  - PHP
  - Printing
  - python
  - QuickLook
  - QuickTime
  - Safari RSS
  - Time Machine
  - Wiki Server
  - X11
  - xar

Several vulnerabilities have been discovered in the FreeType font library. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-1797     Multiple stack-based buffer overflows in the     cff_decoder_parse_charstrings function in the CFF Type2     CharStrings interpreter in cff/cffgload.c in FreeType     allow remote attackers to execute arbitrary code or     cause a denial of service (memory corruption) via     crafted CFF opcodes in embedded fonts in a PDF document,     as demonstrated by JailbreakMe.

  - CVE-2010-2541     Buffer overflow in ftmulti.c in the ftmulti demo program     in FreeType allows remote attackers to cause a denial of     service (application crash) or possibly execute     arbitrary code via a crafted font file.

  - CVE-2010-2805     The FT_Stream_EnterFrame function in base/ftstream.c in     FreeType does not properly validate certain position     values, which allows remote attackers to cause a denial     of service (application crash) or possibly execute     arbitrary code via a crafted font file

  - CVE-2010-2806     Array index error in the t42_parse_sfnts function in     type42/t42parse.c in FreeType allows remote attackers to     cause a denial of service (application crash) or     possibly execute arbitrary code via negative size values     for certain strings in FontType42 font files, leading to     a heap-based buffer overflow.

  - CVE-2010-2807     FreeType uses incorrect integer data types during bounds     checking, which allows remote attackers to cause a     denial of service (application crash) or possibly     execute arbitrary code via a crafted font file.

  - CVE-2010-2808     Buffer overflow in the Mac_Read_POST_Resource function     in base/ftobjs.c in FreeType allows remote attackers to     cause a denial of service (memory corruption and     application crash) or possibly execute arbitrary code     via a crafted Adobe Type 1 Mac Font File (aka LWFN)     font.

  - CVE-2010-3053     bdf/bdflib.c in FreeType allows remote attackers to     cause a denial of service (application crash) via a     crafted BDF font file, related to an attempted     modification of a value in a static string.

- Mon Oct 4 2010 Marek Kasik <mkasik at redhat.com>     2.3.11-6

    - Add freetype-2.3.11-CVE-2010-2805.patch (Fix       comparison.)

  - Add freetype-2.3.11-CVE-2010-2806.patch (Protect against     negative string_size. Fix comparison.)

  - Add freetype-2.3.11-CVE-2010-2808.patch (Check the total     length of collected POST segments.)

  - Add freetype-2.3.11-CVE-2010-3311.patch (Don't seek     behind end of stream.)

  - Resolves: #638522

    - Mon Oct 4 2010 Marek Kasik <mkasik at redhat.com>       2.3.11-5

    - Add freetype-2.3.11-CVE-2010-1797.patch (Check stack       after execution of operations too. Skip the       evaluations of the values in decoder, if       cff_decoder_parse_charstrings() returns any error.)

  - Resolves: #621627

    - Fri Oct 1 2010 Marek Kasik <mkasik at redhat.com>       2.3.11-4

    - Add freetype-2.3.11-CVE-2010-2498.patch (Assure that       `end_point' is not larger than `glyph->num_points')

  - Add freetype-2.3.11-CVE-2010-2499.patch (Check the     buffer size during gathering PFB fragments)

  - Add freetype-2.3.11-CVE-2010-2500.patch (Use smaller     threshold values for `width' and `height')

  - Add freetype-2.3.11-CVE-2010-2519.patch (Check `rlen'     the length of fragment declared in the POST fragment     header)

  - Add freetype-2.3.11-CVE-2010-2520.patch (Fix bounds     check)

  - Add freetype-2.3.11-CVE-2010-2527.patch (Use precision     for `%s' where appropriate to avoid buffer overflows)

  - Add freetype-2.3.11-CVE-2010-2541.patch (Avoid overflow     when dealing with names of axes)

  - Resolves: #613299

    - Thu Dec 3 2009 Behdad Esfahbod <behdad at redhat.com>       2.3.11-3

    - Add freetype-2.3.11-more-demos.patch

    - New demo programs ftmemchk, ftpatchk, and fttimer

    - Thu Dec 3 2009 Behdad Esfahbod <behdad at redhat.com>       2.3.11-2

    - Second try. Drop upstreamed patches.

    - Thu Dec 3 2009 Behdad Esfahbod <behdad at redhat.com>       2.3.11-1

    - 2.3.11

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
49854	SuSE 10 Security Update : freetype2 (ZYPP Patch Number 7121)	Nessus	SuSE Local Security Checks	2010/10/11	2021/1/14	high
50905	SuSE 11 / 11.1 Security Update : freetype2 (SAT Patch Numbers 2914 / 2919)	Nessus	SuSE Local Security Checks	2010/12/2	2021/1/14	high
75578	openSUSE Security Update : libfreetype6 (openSUSE-SU-2010:0549-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	high
60890	Scientific Linux Security Update : freetype on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
284014	MiracleLinux 3 : freetype-2.2.1-28.0.1.AXS3 (AXSA:2010-460:03)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	high
50548	Mac OS X 10.6.x < 10.6.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2010/11/10	2024/5/28	critical
48753	openSUSE Security Update : freetype2 (openSUSE-SU-2010:0549-1)	Nessus	SuSE Local Security Checks	2010/8/26	2021/1/14	high
49150	Debian DSA-2105-1 : freetype - several vulnerabilities	Nessus	Debian Local Security Checks	2010/9/9	2021/1/4	high
50437	Fedora 12 : freetype-2.3.11-6.fc12 (2010-15785)	Nessus	Fedora Local Security Checks	2010/11/2	2021/1/11	high

偵測

搜尋 Plugin

high

high

high

high

high

critical

high

high

high