http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/src/psaux/psobjs.c?id=db5a4a9ae7b0048f033361744421da8569642f73

[debian-lts-announce] 20190904 [SECURITY] [DLA 1909-1] freetype security update

https://savannah.nongnu.org/bugs/?45922

USN-4126-2

FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation. (CVE-2015-9382)

Impact

An attacker may be able to use a maliciously crafted file to create a buffer overflow and potentially expose small amounts of memory from the PostScript process.

The remote NewStart CGSL host, running version MAIN 4.05, has freetype packages installed that are affected by multiple vulnerabilities:

  - FreeType before 2.6.1 has a heap-based buffer over-read     in T1_Get_Private_Dict in type1/t1parse.c.
    (CVE-2015-9381)

  - FreeType before 2.6.1 has a buffer over-read in     skip_comment in psaux/psobjs.c because     ps_parser_skip_PS_token is mishandled in an     FT_New_Memory_Face operation. (CVE-2015-9382)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the freetype package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The t42_parse_encoding function in type42/t42parse.c in     FreeType before 2.5.4 does not properly update the     current position for immediates-only mode, which allows     remote attackers to cause a denial of service (infinite     loop) via a Type42 font.(CVE-2014-9747)

  - FreeType before 2.6.2 has a heap-based buffer over-read     in tt_cmap14_validate in sfnt/ttcmap.c.(CVE-2015-9383)

  - FreeType before 2.6.1 has a buffer over-read in     skip_comment in psaux/psobjs.c because     ps_parser_skip_PS_token is mishandled in an     FT_New_Memory_Face operation.(CVE-2015-9382)

  - FreeType before 2.6.1 has a heap-based buffer over-read     in T1_Get_Private_Dict in     type1/t1parse.c.(CVE-2015-9381)

  - In FreeType before 2.6.1, a buffer over-read occurs in     type1/t1parse.c on function T1_Get_Private_Dict where     there is no check that the new values of cur and limit     are sensible before going to Again.(CVE-2015-9290)

  - The parse_encoding function in type1/t1load.c in     FreeType before 2.5.3 allows remote attackers to cause     a denial of service (infinite loop) via a 'broken     number-with-base' in a Postscript stream, as     demonstrated by 8#garbage.(CVE-2014-9745)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c. (CVE-2015-9381)

FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation. (CVE-2015-9382)

According to the versions of the freetype package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The FreeType engine is a free and portable font     rendering engine, developed to provide advanced font     support for a variety of platforms and environments.
    FreeType is a library which can open and manages font     files as well as efficiently load, hint and render     individual glyphs. FreeType is not a font server or a     complete text-rendering library. Security Fix(es):The     t42_parse_encoding function in type42/t42parse.c in     FreeType before 2.5.4 does not properly update the     current position for immediates-only mode, which allows     remote attackers to cause a denial of service (infinite     loop) via a Type42 font.(CVE-2014-9747)In Sudo before     1.8.28, an attacker with access to a Runas ALL sudoer     account can bypass certain policy blacklists and     session PAM modules, and can cause incorrect logging,     by invoking sudo with a crafted user ID. For example,     this allows bypass of !root configuration, and USER=     logging, for a 'sudo -u \#$((0xffffffff))'     command.(CVE-2015-9383)FreeType before 2.6.1 has a     buffer over-read in skip_comment in psaux/psobjs.c     because ps_parser_skip_PS_token is mishandled in an     FT_New_Memory_Face operation.(CVE-2015-9382)FreeType     before 2.6.1 has a heap-based buffer over-read in     T1_Get_Private_Dict in     type1/t1parse.c.(CVE-2015-9381)In FreeType before     2.6.1, a buffer over-read occurs in type1/t1parse.c on     function T1_Get_Private_Dict where there is no check     that the new values of cur and limit are sensible     before going to Again.(CVE-2015-9290)The parse_encoding     function in type1/t1load.c in FreeType before 2.5.3     allows remote attackers to cause a denial of service     (infinite loop) via a 'broken number-with-base' in a     Postscript stream, as demonstrated by     8#garbage.(CVE-2014-9745)The parse_charstrings function     in type1/t1load.c in FreeType 2 before 2.7 does not     ensure that a font contains a glyph name, which allows     remote attackers to cause a denial of service     (heap-based buffer over-read) or possibly have     unspecified other impact via a crafted     file.(CVE-2016-10244)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for freetype is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType loads, hints, and renders individual glyphs efficiently.

Security Fix(es) :

* freetype: a heap-based buffer over-read in T1_Get_Private_Dict in type1/ t1parse.c leading to information disclosure (CVE-2015-9381)

* freetype: mishandling ps_parser_skip_PS_token in an FT_New_Memory_Face operation in skip_comment, psaux/psobjs.c, leads to a buffer over-read (CVE-2015-9382)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Security Fix(es) :

  - freetype: a heap-based buffer over-read in     T1_Get_Private_Dict in type1/t1parse.c leading to     information disclosure (CVE-2015-9381)

  - freetype: mishandling ps_parser_skip_PS_token in an     FT_New_Memory_Face operation in skip_comment,     psaux/psobjs.c, leads to a buffer over-read     (CVE-2015-9382)

From Red Hat Security Advisory 2019:4254 :

An update for freetype is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType loads, hints, and renders individual glyphs efficiently.

Security Fix(es) :

* freetype: a heap-based buffer over-read in T1_Get_Private_Dict in type1/ t1parse.c leading to information disclosure (CVE-2015-9381)

* freetype: mishandling ps_parser_skip_PS_token in an FT_New_Memory_Face operation in skip_comment, psaux/psobjs.c, leads to a buffer over-read (CVE-2015-9382)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

According to the versions of the freetype packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The parse_encoding function in type1/t1load.c in     FreeType before 2.5.3 allows remote attackers to cause     a denial of service (infinite loop) via a 'broken     number-with-base' in a Postscript stream, as     demonstrated by 8#garbage.(CVE-2014-9745)

  - The t42_parse_encoding function in type42/t42parse.c in     FreeType before 2.5.4 does not properly update the     current position for immediates-only mode, which allows     remote attackers to cause a denial of service (infinite     loop) via a Type42 font.(CVE-2014-9747)

  - FreeType before 2.6.1 has a heap-based buffer over-read     in T1_Get_Private_Dict in     type1/t1parse.c.(CVE-2015-9381)

  - FreeType before 2.6.1 has a buffer over-read in     skip_comment in psaux/psobjs.c because     ps_parser_skip_PS_token is mishandled in an     FT_New_Memory_Face operation.(CVE-2015-9382)

  - FreeType before 2.6.2 has a heap-based buffer over-read     in tt_cmap14_validate in sfnt/ttcmap.c.(CVE-2015-9383)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the freetype packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The parse_encoding function in type1/t1load.c in     FreeType before 2.5.3 allows remote attackers to cause     a denial of service (infinite loop) via a 'broken     number-with-base' in a Postscript stream, as     demonstrated by 8#garbage.(CVE-2014-9745)

  - The t42_parse_encoding function in type42/t42parse.c in     FreeType before 2.5.4 does not properly update the     current position for immediates-only mode, which allows     remote attackers to cause a denial of service (infinite     loop) via a Type42 font.(CVE-2014-9747)

  - FreeType before 2.6.1 has a buffer over-read in     skip_comment in psaux/psobjs.c because     ps_parser_skip_PS_token is mishandled in an     FT_New_Memory_Face operation.(CVE-2015-9382)

  - FreeType before 2.6.2 has a heap-based buffer over-read     in tt_cmap14_validate in sfnt/ttcmap.c.(CVE-2015-9383)

  - FreeType before 2.6.1 has a heap-based buffer over-read     in T1_Get_Private_Dict in     type1/t1parse.c.(CVE-2015-9381)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the freetype packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The t42_parse_encoding function in type42/t42parse.c in     FreeType before 2.5.4 does not properly update the     current position for immediates-only mode, which allows     remote attackers to cause a denial of service (infinite     loop) via a Type42 font.(CVE-2014-9747)

  - The parse_encoding function in type1/t1load.c in     FreeType before 2.5.3 allows remote attackers to cause     a denial of service (infinite loop) via a 'broken     number-with-base' in a Postscript stream, as     demonstrated by 8#garbage.(CVE-2014-9745)

  - In FreeType before 2.6.1, a buffer over-read occurs in     type1/t1parse.c on function T1_Get_Private_Dict where     there is no check that the new values of cur and limit     are sensible before going to Again.(CVE-2015-9290)

  - FreeType before 2.6.1 has a heap-based buffer over-read     in T1_Get_Private_Dict in     type1/t1parse.c.(CVE-2015-9381)

  - FreeType before 2.6.1 has a buffer over-read in     skip_comment in psaux/psobjs.c because     ps_parser_skip_PS_token is mishandled in an     FT_New_Memory_Face operation.(CVE-2015-9382)

  - FreeType before 2.6.2 has a heap-based buffer over-read     in tt_cmap14_validate in sfnt/ttcmap.c.(CVE-2015-9383)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several newly-referenced issues have been fixed in the FreeType 2 font engine.

CVE-2015-9381

heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c

CVE-2015-9382

buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation

CVE-2015-9383

a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c

For Debian 8 'Jessie', these problems have been fixed in version 2.5.2-3+deb8u4.

We recommend that you upgrade your freetype packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

GNOME is the default desktop environment of Red Hat Enterprise Linux.

Security Fix(es) :

* libsoup: Crash in soup_cookie_jar.c:get_cookies() on empty hostnames (CVE-2018-12910)

* poppler: Infinite recursion in fofi/FoFiType1C.cc:FoFiType1C::cvtGlyph() function allows denial of service (CVE-2017-18267)

* libgxps: heap based buffer over read in ft_font_face_hash function of gxps-fonts.c (CVE-2018-10733)

* libgxps: Stack-based buffer overflow in calling glib in gxps_images_guess_content_type of gcontenttype.c (CVE-2018-10767)

* poppler: NULL pointer dereference in Annot.h:AnnotPath::getCoordsLength() allows for denial of service via crafted PDF (CVE-2018-10768)

* poppler: out of bounds read in pdfunite (CVE-2018-13988)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank chenyuan (NESA Lab) for reporting CVE-2018-10733 and CVE-2018-10767 and Hosein Askari for reporting CVE-2018-13988.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

ID	Name	Product	Family	Severity
147524	F5 Networks BIG-IP : FreeType vulnerability (K46641512)	Nessus	F5 Networks Local Security Checks	medium
135763	NewStart CGSL MAIN 4.05 : freetype Multiple Vulnerabilities (NS-SA-2020-0015)	Nessus	NewStart CGSL Local Security Checks	high
135653	EulerOS Virtualization 3.0.2.2 : freetype (EulerOS-SA-2020-1491)	Nessus	Huawei Local Security Checks	critical
134570	Amazon Linux AMI : freetype (ALAS-2020-1348)	Nessus	Amazon Linux Local Security Checks	high
134513	EulerOS Virtualization for ARM 64 3.0.2.0 : freetype (EulerOS-SA-2020-1224)	Nessus	Huawei Local Security Checks	critical
132403	CentOS 6 : freetype (CESA-2019:4254)	Nessus	CentOS Local Security Checks	high
132306	Scientific Linux Security Update : freetype on SL6.x i386/x86_64 (20191217)	Nessus	Scientific Linux Local Security Checks	high
132303	Oracle Linux 6 : freetype (ELSA-2019-4254)	Nessus	Oracle Linux Local Security Checks	high
132298	EulerOS 2.0 SP3 : freetype (EulerOS-SA-2019-2581)	Nessus	Huawei Local Security Checks	high
132231	RHEL 6 : freetype (RHSA-2019:4254)	Nessus	Red Hat Local Security Checks	high
131667	EulerOS 2.0 SP2 : freetype (EulerOS-SA-2019-2514)	Nessus	Huawei Local Security Checks	high
130857	EulerOS 2.0 SP5 : freetype (EulerOS-SA-2019-2148)	Nessus	Huawei Local Security Checks	critical
128509	Debian DLA-1909-1 : freetype security update	Nessus	Debian Local Security Checks	high
118995	CentOS 7 : PackageKit / accountsservice / adwaita-icon-theme / appstream-data / at-spi2-atk / etc (CESA-2018:3140)	Nessus	CentOS Local Security Checks	critical
118726	RHEL 7 : GNOME (RHSA-2018:3140)	Nessus	Red Hat Local Security Checks	critical

CVE-2015-9382

medium

New! CVE Severity Now Using CVSS v3

Description

References

Details

Risk Information

CVSS v2

CVSS v3

Vulnerable Software

Configuration 1

Configuration 2

Tenable Plugins

medium

high

critical

high

critical

high

high

high

high

high

high

critical

high

critical

critical