FreeType 2.4.1 Memory corruption flaw by processing certain

2010.08.22

Credit: Jan Lieskovsky

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2010-2808

CWE: CWE-399

CVSS Base Score: 6.8/10

Impact Subscore: 6.4/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

   A memory corruption flaw was found in the way FreeType font rendering engine
processed certain Adobe Type 1 Mac Font File (LWFN) fonts. An attacker
could use this flaw to create a specially-crafted font file that, when
opened, would cause an application linked against libfreetype to crash,
or, possibly execute arbitrary code.

Upstream bug report:
[1] https://savannah.nongnu.org/bugs/?30658

Public reproducer:
[2] http://alt.swiecki.net/j/f/sigsegv31.ttf

Upstream changeset:
[3] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=81f3472c0ba7b8f6466e2e214fa8c1c17fade975

References:
[4] https://bugzilla.redhat.com/show_bug.cgi?id=621907

Credit: Robert Swiecki

Could you allocate a CVE id for this?

Thanks && Regards, Jan.

References:

http://www.securityfocus.com/bid/42285

https://savannah.nongnu.org/bugs/?30658

https://bugzilla.redhat.com/show_bug.cgi?id=621907

https://bugs.launchpad.net/ubuntu/maverick/+source/freetype/+bug/617019

http://www.vupen.com/english/advisories/2010/2106

http://www.vupen.com/english/advisories/2010/2018

http://www.ubuntu.com/usn/USN-972-1

http://sourceforge.net/projects/freetype/files/freetype2/2.4.2/NEWS/view

http://secunia.com/advisories/40982

http://secunia.com/advisories/40816

http://marc.info/?l=oss-security&m=128111955616772&w=2

http://marc.info/?l=oss-security&m=128110167119337&w=2

http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=81f3472c0ba7b8f6466e2e214fa8c1c17fade975

http://freetype.sourceforge.net/index2.html#release-freetype-2.4.2

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

FreeType 2.4.1 Memory corruption flaw by processing certain

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.