The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to BDF fonts and an incorrect calculation that triggers an out-of-bounds read.

The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to BDF fonts and an incorrect calculation that triggers an out-of-bounds read.
(CVE-2012-5669)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fixes (CVE-2014-9657)

  - Check minimum size of `record_size'.

  - Fixes (CVE-2014-9658)

  - Use correct value for minimum table length test.

  - Fixes (CVE-2014-9675)

  - New macro that checks one character more than `strncmp'.

  - Fixes (CVE-2014-9660)

  - Check `_BDF_GLYPH_BITS'.

  - Fixes (CVE-2014-9661)

  - Initialize `face->ttf_size'.

  - Always set `face->ttf_size' directly.

  - Exclusively use the `truetype' font driver for loading     the font contained in the `sfnts' array.

  - Fixes (CVE-2014-9663)

  - Fix order of validity tests.

  - Fixes (CVE-2014-9664)

  - Add another boundary testing.

  - Fix boundary testing.

  - Fixes (CVE-2014-9667)

  - Protect against addition overflow.

  - Fixes (CVE-2014-9669)

  - Protect against overflow in additions and     multiplications.

  - Fixes (CVE-2014-9670)

  - Add sanity checks for row and column values.

  - Fixes (CVE-2014-9671)

  - Check `size' and `offset' values.

  - Fixes (CVE-2014-9673)

  - Fix integer overflow by a broken POST table in     resource-fork.

  - Fixes (CVE-2014-9674)

  - Fix integer overflow by a broken POST table in     resource-fork.

  - Additional overflow check in the summation of POST     fragment lengths.

  - Work around behaviour of X11's `pcfWriteFont' and     `pcfReadFont' functions

  - Resolves: #1197737

  - Fix (CVE-2012-5669) (Use correct array size for checking     `glyph_enc')

  - Resolves: #903543

The remote Solaris system is missing necessary patches to address security updates :

  - FreeType before 2.4.11 allows context-dependent     attackers to cause a denial of service (NULL pointer     dereference and crash) via vectors related to BDF fonts     and the improper handling of an 'allocation error' in     the bdf_free_font function. (CVE-2012-5668)

  - The _bdf_parse_glyphs function in FreeType before 2.4.11     allows context-dependent attackers to cause a denial of     service (crash) and possibly execute arbitrary code via     vectors related to BDF fonts and an incorrect     calculation that triggers an out-of-bounds read.
    (CVE-2012-5669)

  - The _bdf_parse_glyphs function in FreeType before 2.4.11     allows context-dependent attackers to cause a denial of     service (out-of-bounds write and crash) via vectors     related to BDF fonts and an ENCODING field with a     negative value. (CVE-2012-5670)

- BNC#795826, CVE-2012-5668.patch [bdf] Fix Savannah bug     #37905.

  - src/bdf/bdflib.c (_bdf_parse_start): Reset `props_size'     to zero in case of allocation error; this value gets     used in a loop in

  - BNC#795826, CVE-2012-5669.patch [bdf] Fix Savannah bug     #37906.

  - src/bdf/bdflib.c (_bdf_parse_glyphs): Use correct array     size for checking `glyph_enc'.

  - BNC#795826, CVE-2012-5670.patch [bdf] Fix Savannah bug     #37907.

  - src/bdf/bdflib.c (_bdf_parse_glyphs) <ENCODING>:
    Normalize negative second parameter of `ENCODING' field     also.

- new license string.

  - BNC#795826, CVE-2012-5668.patch

  - BNC#795826, CVE-2012-5669.patch [bdf] Fix Savannah bug     #37906.

  - src/bdf/bdflib.c (_bdf_parse_glyphs): Use correct array     size for checking `glyph_enc'.

The remote host is affected by the vulnerability described in GLSA-201402-16 (FreeType: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FreeType. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted font, possibly resulting in execution of arbitrary code with the       privileges of the user running the application, or a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

A flaw was found in the way the FreeType font rendering engine processed certain Glyph Bitmap Distribution Format (BDF) fonts. If a user loaded a specially crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2012-5669)

From Red Hat Security Advisory 2013:0216 :

Updated freetype packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently.

A flaw was found in the way the FreeType font rendering engine processed certain Glyph Bitmap Distribution Format (BDF) fonts. If a user loaded a specially crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2012-5669)

Users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The X server must be restarted (log out, then log back in) for this update to take effect.

Updated freetype2 packages fixes security vulnerabilities :

A NULL pointer de-reference flaw was found in the way Freetype font rendering engine handled Glyph bitmap distribution format (BDF) fonts.
A remote attacker could provide a specially crafted BDF font file, which once processed in an application linked against FreeType would lead to that application crash (CVE-2012-5668).

An out-of heap-based buffer read flaw was found in the way FreeType font rendering engine performed parsing of glyph information and relevant bitmaps for glyph bitmap distribution format (BDF). A remote attacker could provide a specially crafted BDF font file, which once opened in an application linked against FreeType would lead to that application crash (CVE-2012-5669).

An out-of heap-based buffer write flaw was found in the way FreeType font rendering engine performed parsing of glyph information and relevant bitmaps for glyph bitmap distribution format (BDF). A remote attacker could provide a specially crafted font file, which once opened in an application linked against FreeType would lead to that application crash, or, potentially, arbitrary code execution with the privileges of the user running the application (CVE-2012-5670).

This update fixes CVE-2012-5669.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been found and corrected in freetype2 :

A NULL pointer de-reference flaw was found in the way Freetype font rendering engine handled Glyph bitmap distribution format (BDF) fonts.
A remote attacker could provide a specially crafted BDF font file, which once processed in an application linked against FreeType would lead to that application crash (CVE-2012-5668).

An out-of heap-based buffer read flaw was found in the way FreeType font rendering engine performed parsing of glyph information and relevant bitmaps for glyph bitmap distribution format (BDF). A remote attacker could provide a specially crafted BDF font file, which once opened in an application linked against FreeType would lead to that application crash (CVE-2012-5669).

The updated packages have been patched to correct these issues.

A flaw was found in the way the FreeType font rendering engine processed certain Glyph Bitmap Distribution Format (BDF) fonts. If a user loaded a specially crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2012-5669)

The X server must be restarted (log out, then log back in) for this update to take effect.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:0216 advisory.

  - freetype: heap buffer over-read in BDF parsing _bdf_parse_glyphs() (#37906) (CVE-2012-5669)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated freetype packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently.

A flaw was found in the way the FreeType font rendering engine processed certain Glyph Bitmap Distribution Format (BDF) fonts. If a user loaded a specially crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2012-5669)

Users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The X server must be restarted (log out, then log back in) for this update to take effect.

This update fixes :

  - OOB access in bdf_free_font() and _bdf_parse_glyphs()     (CVE-2012-5668 / CVE-2012-5669) As well as the following     non-security bugs :

  - [bdf] Savannah bug #37905.

  - src/bdf/bdflib.c (_bdf_parse_start): Reset `props_size'     to zero in case of allocation error; this value gets     used in a loop in

  - [bdf] Fix Savannah bug #37906.

  - src/bdf/bdflib.c (_bdf_parse_glyphs): Use correct array     size for checking `glyph_enc'.

New freetype packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix security issues.

Mateusz Jurczyk discovered that FreeType did not correctly handle certain malformed BDF font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash or possibly execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
88531	F5 Networks BIG-IP : BDF parsing vulnerability (K15095307)	Nessus	F5 Networks Local Security Checks	medium
81967	OracleVM 3.3 : freetype (OVMSA-2015-0036)	Nessus	OracleVM Local Security Checks	high
80614	Oracle Solaris Third-Party Patch Update : freetype (multiple_buffer_errors_vulnerabilities_in)	Nessus	Solaris Local Security Checks	medium
75015	openSUSE Security Update : freetype2 (openSUSE-SU-2013:0165-1)	Nessus	SuSE Local Security Checks	medium
75003	openSUSE Security Update : freetype2 (openSUSE-SU-2013:0177-1)	Nessus	SuSE Local Security Checks	medium
72453	GLSA-201402-16 : FreeType: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
69709	Amazon Linux AMI : freetype (ALAS-2013-150)	Nessus	Amazon Linux Local Security Checks	medium
68720	Oracle Linux 5 / 6 : freetype (ELSA-2013-0216)	Nessus	Oracle Linux Local Security Checks	medium
66053	Mandriva Linux Security Advisory : freetype2 (MDVSA-2013:039)	Nessus	Mandriva Local Security Checks	medium
64593	Fedora 17 : freetype-2.4.8-4.fc17 (2013-1466)	Nessus	Fedora Local Security Checks	medium
64504	Mandriva Linux Security Advisory : freetype2 (MDVSA-2013:006)	Nessus	Mandriva Local Security Checks	medium
64464	Fedora 18 : freetype-2.4.10-3.fc18 (2013-1492)	Nessus	Fedora Local Security Checks	medium
64424	Scientific Linux Security Update : freetype on SL5.x, SL6.x i386/x86_64 (20130131)	Nessus	Scientific Linux Local Security Checks	medium
64390	RHEL 5 / 6 : freetype (RHSA-2013:0216)	Nessus	Red Hat Local Security Checks	critical
64383	CentOS 5 / 6 : freetype (CESA-2013:0216)	Nessus	CentOS Local Security Checks	medium
64144	SuSE 11.2 Security Update : freetype2 (SAT Patch Number 7232)	Nessus	SuSE Local Security Checks	medium
63555	Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : freetype (SSA:2013-015-01)	Nessus	Slackware Local Security Checks	medium
63536	Ubuntu 8.04 LTS / 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : freetype vulnerabilities (USN-1686-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2012-5669

critical

Tenable Plugins

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium