Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF Type2 CharStrings interpreter in cff/cffgload.c in FreeType before 2.4.2, as used in Apple iOS before 4.0.2 on the iPhone and iPod touch and before 3.2.2 on the iPad, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted CFF opcodes in embedded fonts in a PDF document, as demonstrated by JailbreakMe. NOTE: some of these details are obtained from third party information.

This update of freetype2 fixes several vulnerabilities that could lead to remote system compromise by executing arbitrary code with user privileges :

  - CVE-2010-1797: stack-based buffer overflow while     processing CFF opcodes

  - CVE-2010-2497: integer underflow

  - CVE-2010-2498: invalid free

  - CVE-2010-2499: buffer overflow

  - CVE-2010-2500: integer overflow

  - CVE-2010-2519: heap buffer overflow

  - CVE-2010-2520: heap buffer overflow

  - CVE-2010-2527: buffer overflows in the freetype demo

  - CVE-2010-2541: buffer overflow in ftmulti demo program

  - CVE-2010-2805: improper bounds checking

  - CVE-2010-2806: improper bounds checking

  - CVE-2010-2807: improper type comparisons

  - CVE-2010-2808: memory corruption flaw by processing     certain LWFN fonts

From Red Hat Security Advisory 2010:0607 :

Updated freetype packages that fix two security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently. The freetype packages for Red Hat Enterprise Linux 3 and 4 provide both the FreeType 1 and FreeType 2 font engines. The freetype packages for Red Hat Enterprise Linux 5 provide only the FreeType 2 font engine.

Two stack overflow flaws were found in the way the FreeType font engine processed certain Compact Font Format (CFF) character strings (opcodes). If a user loaded a specially crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-1797)

Red Hat would like to thank Braden Thomas of the Apple Product Security team for reporting these issues.

Note: CVE-2010-1797 only affects the FreeType 2 font engine.

Users are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. The X server must be restarted (log out, then log back in) for this update to take effect.

Two stack overflow flaws were found in the way the FreeType font engine processed certain Compact Font Format (CFF) character strings (opcodes). If a user loaded a specially crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-1797)

Note: CVE-2010-1797 only affects the FreeType 2 font engine.

The X server must be restarted (log out, then log back in) for this update to take effect.

The remote host is affected by the vulnerability described in GLSA-201201-09 (FreeType: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FreeType. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted font,       possibly resulting in the remote execution of arbitrary code with the       privileges of the user running the application, or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

This update of freetype2 fixes several vulnerabilities that could lead to remote system compromise by executing arbitrary code with user privileges :

  - stack-based buffer overflow while processing CFF     opcodes. (CVE-2010-1797)

  - integer underflow. (CVE-2010-2497)

  - invalid free. (CVE-2010-2498)

  - buffer overflow. (CVE-2010-2499)

  - integer overflow. (CVE-2010-2500)

  - heap buffer overflow. (CVE-2010-2519)

  - heap buffer overflow. (CVE-2010-2520)

  - buffer overflows in the freetype demo. (CVE-2010-2527)

  - buffer overflow in ftmulti demo program. (CVE-2010-2541)

  - improper bounds checking. (CVE-2010-2805)

  - improper bounds checking. (CVE-2010-2806)

  - improper type comparisons. (CVE-2010-2807)

  - memory corruption flaw by processing certain LWFN fonts.
    (CVE-2010-2808)

- Mon Oct 4 2010 Marek Kasik <mkasik at redhat.com>     2.3.11-6

    - Add freetype-2.3.11-CVE-2010-2805.patch (Fix       comparison.)

  - Add freetype-2.3.11-CVE-2010-2806.patch (Protect against     negative string_size. Fix comparison.)

  - Add freetype-2.3.11-CVE-2010-2808.patch (Check the total     length of collected POST segments.)

  - Add freetype-2.3.11-CVE-2010-3311.patch (Don't seek     behind end of stream.)

  - Resolves: #638522

    - Mon Oct 4 2010 Marek Kasik <mkasik at redhat.com>       2.3.11-5

    - Add freetype-2.3.11-CVE-2010-1797.patch (Check stack       after execution of operations too. Skip the       evaluations of the values in decoder, if       cff_decoder_parse_charstrings() returns any error.)

  - Resolves: #621627

    - Fri Oct 1 2010 Marek Kasik <mkasik at redhat.com>       2.3.11-4

    - Add freetype-2.3.11-CVE-2010-2498.patch (Assure that       `end_point' is not larger than `glyph->num_points')

  - Add freetype-2.3.11-CVE-2010-2499.patch (Check the     buffer size during gathering PFB fragments)

  - Add freetype-2.3.11-CVE-2010-2500.patch (Use smaller     threshold values for `width' and `height')

  - Add freetype-2.3.11-CVE-2010-2519.patch (Check `rlen'     the length of fragment declared in the POST fragment     header)

  - Add freetype-2.3.11-CVE-2010-2520.patch (Fix bounds     check)

  - Add freetype-2.3.11-CVE-2010-2527.patch (Use precision     for `%s' where appropriate to avoid buffer overflows)

  - Add freetype-2.3.11-CVE-2010-2541.patch (Avoid overflow     when dealing with names of axes)

  - Resolves: #613299

    - Thu Dec 3 2009 Behdad Esfahbod <behdad at redhat.com>       2.3.11-3

    - Add freetype-2.3.11-more-demos.patch

    - New demo programs ftmemchk, ftpatchk, and fttimer

    - Thu Dec 3 2009 Behdad Esfahbod <behdad at redhat.com>       2.3.11-2

    - Second try. Drop upstreamed patches.

    - Thu Dec 3 2009 Behdad Esfahbod <behdad at redhat.com>       2.3.11-1

    - 2.3.11

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Mon Oct 4 2010 Marek Kasik <mkasik at redhat.com>     2.3.11-6

    - Add freetype-2.3.11-CVE-2010-2805.patch (Fix       comparison.)

  - Add freetype-2.3.11-CVE-2010-2806.patch (Protect against     negative string_size. Fix comparison.)

  - Add freetype-2.3.11-CVE-2010-2808.patch (Check the total     length of collected POST segments.)

  - Add freetype-2.3.11-CVE-2010-3311.patch (Don't seek     behind end of stream.)

  - Resolves: #638522

    - Mon Oct 4 2010 Marek Kasik <mkasik at redhat.com>       2.3.11-5

    - Add freetype-2.3.11-CVE-2010-1797.patch (Check stack       after execution of operations too. Skip the       evaluations of the values in decoder, if       cff_decoder_parse_charstrings() returns any error.)

  - Resolves: #621627

    - Fri Oct 1 2010 Marek Kasik <mkasik at redhat.com>       2.3.11-4

    - Add freetype-2.3.11-CVE-2010-2498.patch (Assure that       `end_point' is not larger than `glyph->num_points')

  - Add freetype-2.3.11-CVE-2010-2499.patch (Check the     buffer size during gathering PFB fragments)

  - Add freetype-2.3.11-CVE-2010-2500.patch (Use smaller     threshold values for `width' and `height')

  - Add freetype-2.3.11-CVE-2010-2519.patch (Check `rlen'     the length of fragment declared in the POST fragment     header)

  - Add freetype-2.3.11-CVE-2010-2520.patch (Fix bounds     check)

  - Add freetype-2.3.11-CVE-2010-2527.patch (Use precision     for `%s' where appropriate to avoid buffer overflows)

  - Add freetype-2.3.11-CVE-2010-2541.patch (Avoid overflow     when dealing with names of axes)

  - Resolves: #613299

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the FreeType font library. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-1797     Multiple stack-based buffer overflows in the     cff_decoder_parse_charstrings function in the CFF Type2     CharStrings interpreter in cff/cffgload.c in FreeType     allow remote attackers to execute arbitrary code or     cause a denial of service (memory corruption) via     crafted CFF opcodes in embedded fonts in a PDF document,     as demonstrated by JailbreakMe.

  - CVE-2010-2541     Buffer overflow in ftmulti.c in the ftmulti demo program     in FreeType allows remote attackers to cause a denial of     service (application crash) or possibly execute     arbitrary code via a crafted font file.

  - CVE-2010-2805     The FT_Stream_EnterFrame function in base/ftstream.c in     FreeType does not properly validate certain position     values, which allows remote attackers to cause a denial     of service (application crash) or possibly execute     arbitrary code via a crafted font file

  - CVE-2010-2806     Array index error in the t42_parse_sfnts function in     type42/t42parse.c in FreeType allows remote attackers to     cause a denial of service (application crash) or     possibly execute arbitrary code via negative size values     for certain strings in FontType42 font files, leading to     a heap-based buffer overflow.

  - CVE-2010-2807     FreeType uses incorrect integer data types during bounds     checking, which allows remote attackers to cause a     denial of service (application crash) or possibly     execute arbitrary code via a crafted font file.

  - CVE-2010-2808     Buffer overflow in the Mac_Read_POST_Resource function     in base/ftobjs.c in FreeType allows remote attackers to     cause a denial of service (memory corruption and     application crash) or possibly execute arbitrary code     via a crafted Adobe Type 1 Mac Font File (aka LWFN)     font.

  - CVE-2010-3053     bdf/bdflib.c in FreeType allows remote attackers to     cause a denial of service (application crash) via a     crafted BDF font file, related to an attempted     modification of a value in a static string.

It was discovered that FreeType did not correctly handle certain malformed font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash or possibly execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been discovered and corrected in freetype2 :

Multiple stack overflow flaws have been reported in the way FreeType font rendering engine processed certain CFF opcodes. An attacker could use these flaws to create a specially crafted font file that, when opened, would cause an application linked against libfreetype to crash, or, possibly execute arbitrary code (CVE-2010-1797).

Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct this issue.

The version of Foxit Reader installed on the remote Windows host is prior to 4.1.1.0805. It is, therefore, affected by a remote code execution vulnerability in the FreeType engine due to multiple stack-based buffer overflow conditions in the CFF Type2 CharStrings interpreter, specifically within the function cff_decoder_parse_charstrings(). An attacker can exploit this, via crafted CFF opcodes in embedded fonts in a PDF document, to cause a denial of service or to execute arbitrary code with the user's privileges.

Updated freetype packages that fix two security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently. The freetype packages for Red Hat Enterprise Linux 3 and 4 provide both the FreeType 1 and FreeType 2 font engines. The freetype packages for Red Hat Enterprise Linux 5 provide only the FreeType 2 font engine.

Two stack overflow flaws were found in the way the FreeType font engine processed certain Compact Font Format (CFF) character strings (opcodes). If a user loaded a specially crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-1797)

Red Hat would like to thank Braden Thomas of the Apple Product Security team for reporting these issues.

Note: CVE-2010-1797 only affects the FreeType 2 font engine.

Users are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. The X server must be restarted (log out, then log back in) for this update to take effect.

ID	Name	Product	Family	Severity
75578	openSUSE Security Update : libfreetype6 (openSUSE-SU-2010:0549-1)	Nessus	SuSE Local Security Checks	high
68080	Oracle Linux 3 / 4 / 5 : freetype (ELSA-2010-0607)	Nessus	Oracle Linux Local Security Checks	high
60830	Scientific Linux Security Update : freetype on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
57651	GLSA-201201-09 : FreeType: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
50905	SuSE 11 / 11.1 Security Update : freetype2 (SAT Patch Numbers 2914 / 2919)	Nessus	SuSE Local Security Checks	high
50437	Fedora 12 : freetype-2.3.11-6.fc12 (2010-15785)	Nessus	Fedora Local Security Checks	high
50026	Fedora 13 : freetype-2.3.11-6.fc13 (2010-15705)	Nessus	Fedora Local Security Checks	high
49854	SuSE 10 Security Update : freetype2 (ZYPP Patch Number 7121)	Nessus	SuSE Local Security Checks	high
49150	Debian DSA-2105-1 : freetype - several vulnerabilities	Nessus	Debian Local Security Checks	high
48900	SuSE9 Security Update : freetype2 (YOU Patch Number 12630)	Nessus	SuSE Local Security Checks	high
48755	openSUSE Security Update : freetype2 (openSUSE-SU-2010:0549-1)	Nessus	SuSE Local Security Checks	high
48753	openSUSE Security Update : freetype2 (openSUSE-SU-2010:0549-1)	Nessus	SuSE Local Security Checks	high
48361	Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : freetype vulnerabilities (USN-972-1)	Nessus	Ubuntu Local Security Checks	high
48319	Mandriva Linux Security Advisory : freetype2 (MDVSA-2010:149)	Nessus	Mandriva Local Security Checks	high
48276	Foxit Reader < 4.1.1.0805 FreeType CFF Opcodes RCE	Nessus	Windows	high
48269	CentOS 3 / 4 / 5 : freetype (CESA-2010:0607)	Nessus	CentOS Local Security Checks	high
48258	RHEL 3 / 4 / 5 : freetype (RHSA-2010:0607)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2010-1797

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high