Debian DSA-2116-1 : freetype - integer overflow

high Nessus Plugin ID 49766

Language:

Synopsis

The remote Debian host is missing a security-related update.

Description

Marc Schoenefeld has found an input stream position error in the way the FreeType font rendering engine processed input file streams. If a user loaded a specially crafted font file with an application linked against FreeType and relevant font glyphs were subsequently rendered with the X FreeType library (libXft), it could cause the application to crash or, possibly execute arbitrary code.

Solution

Upgrade the freetype packages.

After the upgrade, all running applications and services that use libfreetype6 should be restarted. In most cases, logging out and in again should be enough. The script checkrestart from the debian-goodies package or lsof may help to find out which processes are still using the old version of libfreetype6.

For the stable distribution (lenny), these problems have been fixed in version 2.3.7-2+lenny4.

Plugin Details

Severity: High

ID: 49766

File Name: debian_DSA-2116.nasl

Version: 1.11

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 10/6/2010

Updated: 1/4/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:freetype, cpe:/o:debian:debian_linux:5.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 10/4/2010

Reference Information

CVE: CVE-2010-3311

BID: 43700, 43841, 43845

DSA: 2116

Detections

Analytics