Detections
Analytics
Debian DLA-319-1 : freetype security update
critical Nessus Plugin ID 86211
Language:
Synopsis
The remote Debian host is missing a security update.Description
Sergey Gorbaty reported issues related to the FreeType font engine.FreeType improperly handled certain malformed font files, allowing remote attackers to cause a Denial of Service when specially crafted font files were used.
For Debian 6 'Squeeze', these issues have been fixed in freetype version 2.4.2-2.1+squeeze6. We recommend you to upgrade your freetype packages.
Learn more about the Debian Long Term Support (LTS) Project and how to apply these updates at: https://wiki.debian.org/LTS/
NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Upgrade the affected packages.See Also
https://lists.debian.org/debian-lts-announce/2015/09/msg00017.html
Plugin Details
Severity: Critical
ID: 86211
File Name: debian_DLA-319.nasl
Version: 2.10
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 10/1/2015
Updated: 1/11/2021
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:freetype2-demos, p-cpe:/a:debian:debian_linux:libfreetype6, p-cpe:/a:debian:debian_linux:libfreetype6-dev, p-cpe:/a:debian:debian_linux:libfreetype6-udeb, cpe:/o:debian:debian_linux:6.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 9/30/2015