RHSA-2015:0696 — Red Hat Security Advisory: freetype security update

Fixed packages 32

Release	Package	Fixed in
Red Hat · RHEL 6 enterprise_linux:6::client	freetype	0:2.3.11-15.el6_6.1
Red Hat · RHEL 6 enterprise_linux:6::client	freetype-debuginfo	0:2.3.11-15.el6_6.1
Red Hat · RHEL 6 enterprise_linux:6::client	freetype-demos	0:2.3.11-15.el6_6.1
Red Hat · RHEL 6 enterprise_linux:6::client	freetype-devel	0:2.3.11-15.el6_6.1
Red Hat · RHEL 6 enterprise_linux:6::computenode	freetype	0:2.3.11-15.el6_6.1
Red Hat · RHEL 6 enterprise_linux:6::computenode	freetype-debuginfo	0:2.3.11-15.el6_6.1
Red Hat · RHEL 6 enterprise_linux:6::computenode	freetype-demos	0:2.3.11-15.el6_6.1
Red Hat · RHEL 6 enterprise_linux:6::computenode	freetype-devel	0:2.3.11-15.el6_6.1
Red Hat · RHEL 6 enterprise_linux:6::server	freetype	0:2.3.11-15.el6_6.1
Red Hat · RHEL 6 enterprise_linux:6::server	freetype-debuginfo	0:2.3.11-15.el6_6.1
Red Hat · RHEL 6 enterprise_linux:6::server	freetype-demos	0:2.3.11-15.el6_6.1
Red Hat · RHEL 6 enterprise_linux:6::server	freetype-devel	0:2.3.11-15.el6_6.1
Red Hat · RHEL 6 enterprise_linux:6::workstation	freetype	0:2.3.11-15.el6_6.1
Red Hat · RHEL 6 enterprise_linux:6::workstation	freetype-debuginfo	0:2.3.11-15.el6_6.1
Red Hat · RHEL 6 enterprise_linux:6::workstation	freetype-demos	0:2.3.11-15.el6_6.1
Red Hat · RHEL 6 enterprise_linux:6::workstation	freetype-devel	0:2.3.11-15.el6_6.1
Red Hat · RHEL 7 enterprise_linux:7::client	freetype	0:2.4.11-10.el7_1.1
Red Hat · RHEL 7 enterprise_linux:7::client	freetype-debuginfo	0:2.4.11-10.el7_1.1
Red Hat · RHEL 7 enterprise_linux:7::client	freetype-demos	0:2.4.11-10.el7_1.1
Red Hat · RHEL 7 enterprise_linux:7::client	freetype-devel	0:2.4.11-10.el7_1.1
Red Hat · RHEL 7 enterprise_linux:7::computenode	freetype	0:2.4.11-10.el7_1.1
Red Hat · RHEL 7 enterprise_linux:7::computenode	freetype-debuginfo	0:2.4.11-10.el7_1.1
Red Hat · RHEL 7 enterprise_linux:7::computenode	freetype-demos	0:2.4.11-10.el7_1.1
Red Hat · RHEL 7 enterprise_linux:7::computenode	freetype-devel	0:2.4.11-10.el7_1.1
Red Hat · RHEL 7 enterprise_linux:7::server	freetype	0:2.4.11-10.ael7b_1.1
Red Hat · RHEL 7 enterprise_linux:7::server	freetype-debuginfo	0:2.4.11-10.ael7b_1.1
Red Hat · RHEL 7 enterprise_linux:7::server	freetype-demos	0:2.4.11-10.ael7b_1.1
Red Hat · RHEL 7 enterprise_linux:7::server	freetype-devel	0:2.4.11-10.ael7b_1.1
Red Hat · RHEL 7 enterprise_linux:7::workstation	freetype	0:2.4.11-10.el7_1.1
Red Hat · RHEL 7 enterprise_linux:7::workstation	freetype-debuginfo	0:2.4.11-10.el7_1.1
Red Hat · RHEL 7 enterprise_linux:7::workstation	freetype-demos	0:2.4.11-10.el7_1.1
Red Hat · RHEL 7 enterprise_linux:7::workstation	freetype-devel	0:2.4.11-10.el7_1.1

Vulnerabilities 13

Unscored —

CVE-2014-9657

The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size,…

freetype freetype Debian Ubuntu

Feb 8, 2015
Unscored —

CVE-2014-9658

The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, wh…

freetype freetype Debian Ubuntu

Feb 8, 2015
Unscored —

CVE-2014-9660

The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR reco…

freetype freetype Debian Ubuntu

Feb 8, 2015
Unscored —

CVE-2014-9661

type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an erro…

freetype freetype Debian Ubuntu

Feb 8, 2015
Unscored —

CVE-2014-9663

The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that f…

freetype freetype Debian Ubuntu

Feb 8, 2015
Unscored —

CVE-2014-9664

FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attack…

freetype freetype Debian Ubuntu

Feb 8, 2015
Unscored —

CVE-2014-9667

sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which a…

freetype freetype Debian Ubuntu

Feb 8, 2015
Unscored —

CVE-2014-9669

Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of servic…

freetype freetype Debian Ubuntu

Feb 8, 2015
Unscored —

CVE-2014-9670

Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow re…

freetype freetype Debian Ubuntu

Feb 8, 2015
Unscored —

CVE-2014-9671

Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers t…

freetype freetype Debian Ubuntu

Feb 8, 2015
Unscored —

CVE-2014-9673

Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote…

freetype freetype Debian Ubuntu

Feb 8, 2015
Unscored —

CVE-2014-9674

The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values wit…

freetype freetype Debian Ubuntu

Feb 8, 2015
Unscored —

CVE-2014-9675

bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present,…

freetype freetype Debian Ubuntu

Feb 8, 2015

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=1191079
report
https://bugzilla.redhat.com/show_bug.cgi?id=1191080
report
https://bugzilla.redhat.com/show_bug.cgi?id=1191082
report
https://bugzilla.redhat.com/show_bug.cgi?id=1191083
report
https://bugzilla.redhat.com/show_bug.cgi?id=1191085
report
https://bugzilla.redhat.com/show_bug.cgi?id=1191086
report
https://bugzilla.redhat.com/show_bug.cgi?id=1191090
report
https://bugzilla.redhat.com/show_bug.cgi?id=1191092
report
https://bugzilla.redhat.com/show_bug.cgi?id=1191093
report
https://bugzilla.redhat.com/show_bug.cgi?id=1191094
report
https://bugzilla.redhat.com/show_bug.cgi?id=1191096
report
https://bugzilla.redhat.com/show_bug.cgi?id=1191190
report
https://bugzilla.redhat.com/show_bug.cgi?id=1191192
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0696.json
report
https://access.redhat.com/security/cve/CVE-2014-9657
advisory
https://www.cve.org/CVERecord?id=CVE-2014-9657
advisory
https://nvd.nist.gov/vuln/detail/CVE-2014-9657
report
https://access.redhat.com/security/cve/CVE-2014-9658
advisory
https://www.cve.org/CVERecord?id=CVE-2014-9658
advisory
https://nvd.nist.gov/vuln/detail/CVE-2014-9658
report
https://access.redhat.com/security/cve/CVE-2014-9660
advisory
https://www.cve.org/CVERecord?id=CVE-2014-9660
advisory
https://nvd.nist.gov/vuln/detail/CVE-2014-9660
report
https://access.redhat.com/security/cve/CVE-2014-9661
advisory
https://www.cve.org/CVERecord?id=CVE-2014-9661
advisory
https://nvd.nist.gov/vuln/detail/CVE-2014-9661
report
https://access.redhat.com/security/cve/CVE-2014-9663
advisory
https://www.cve.org/CVERecord?id=CVE-2014-9663
advisory
https://nvd.nist.gov/vuln/detail/CVE-2014-9663
report
https://access.redhat.com/security/cve/CVE-2014-9664
advisory
https://www.cve.org/CVERecord?id=CVE-2014-9664
advisory
https://nvd.nist.gov/vuln/detail/CVE-2014-9664
report
https://access.redhat.com/security/cve/CVE-2014-9667
advisory
https://www.cve.org/CVERecord?id=CVE-2014-9667
advisory
https://nvd.nist.gov/vuln/detail/CVE-2014-9667
report
https://access.redhat.com/security/cve/CVE-2014-9669
advisory
https://www.cve.org/CVERecord?id=CVE-2014-9669
advisory
https://nvd.nist.gov/vuln/detail/CVE-2014-9669

Red Hat Security Advisory: freetype security update

Fixed packages 32

Vulnerabilities 13

The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size,…

The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, wh…

The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR reco…

type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an erro…

The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that f…

FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attack…

sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which a…

Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of servic…

Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow re…

Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers t…

Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote…

The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values wit…

bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present,…

References