The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.

According to the versions of the freetype package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The FreeType engine is a free and portable font     rendering engine, developed to provide advanced font     support for a variety of platforms and environments.
    FreeType is a library which can open and manages font     files as well as efficiently load, hint and render     individual glyphs. FreeType is not a font server or a     complete text-rendering library. Security Fix(es):The     t42_parse_encoding function in type42/t42parse.c in     FreeType before 2.5.4 does not properly update the     current position for immediates-only mode, which allows     remote attackers to cause a denial of service (infinite     loop) via a Type42 font.(CVE-2014-9747)In Sudo before     1.8.28, an attacker with access to a Runas ALL sudoer     account can bypass certain policy blacklists and     session PAM modules, and can cause incorrect logging,     by invoking sudo with a crafted user ID. For example,     this allows bypass of !root configuration, and USER=     logging, for a 'sudo -u \#$((0xffffffff))'     command.(CVE-2015-9383)FreeType before 2.6.1 has a     buffer over-read in skip_comment in psaux/psobjs.c     because ps_parser_skip_PS_token is mishandled in an     FT_New_Memory_Face operation.(CVE-2015-9382)FreeType     before 2.6.1 has a heap-based buffer over-read in     T1_Get_Private_Dict in     type1/t1parse.c.(CVE-2015-9381)In FreeType before     2.6.1, a buffer over-read occurs in type1/t1parse.c on     function T1_Get_Private_Dict where there is no check     that the new values of cur and limit are sensible     before going to Again.(CVE-2015-9290)The parse_encoding     function in type1/t1load.c in FreeType before 2.5.3     allows remote attackers to cause a denial of service     (infinite loop) via a 'broken number-with-base' in a     Postscript stream, as demonstrated by     8#garbage.(CVE-2014-9745)The parse_charstrings function     in type1/t1load.c in FreeType 2 before 2.7 does not     ensure that a font contains a glyph name, which allows     remote attackers to cause a denial of service     (heap-based buffer over-read) or possibly have     unspecified other impact via a crafted     file.(CVE-2016-10244)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for freetype2 fixes the following issues: Security issue fixed :

  - CVE-2016-10244: The parse_charstrings function in     type1/t1load.c did not ensure that a font contains a     glyph name, which allowed remote attackers to cause a     denial of service (heap-based buffer over-read) or     possibly have unspecified other impact via a crafted     file (bsc#1028103).

  - CVE-2017-8105: Fixed an out-of-bounds write caused by a     heap-based buffer overflow related to the     t1_decoder_parse_charstrings function in     psaux/t1decode.ca (bsc#1035807)

  - CVE-2017-8287: an out-of-bounds write caused by a     heap-based buffer overflow related to the     t1_builder_close_contour function in psaux/psobjs.c     (bsc#1036457)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for freetype2 fixes the following security issues :

  - CVE-2016-10244: Make sure that the parse_charstrings     function in type1/t1load.c does ensure that a font     contains a glyph name to prevent a DoS through a     heap-based buffer over-read or possibly have unspecified     other impact via a crafted file (bsc#1028103)

  - CVE-2017-8105: Fix an out-of-bounds write caused by a     heap-based buffer overflow related to the     t1_decoder_parse_charstrings function in     psaux/t1decode.ca (bsc#1035807)

  - CVE-2017-8287: an out-of-bounds write caused by a     heap-based buffer overflow related to the     t1_builder_close_contour function in psaux/psobjs.c     (bsc#1036457)

  - Fix several integer overflow issues in     truetype/ttinterp.c (bsc#1079600)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for freetype2 fixes the following security issues :

  - CVE-2016-10244: Make sure that the parse_charstrings     function in type1/t1load.c does ensure that a font     contains a glyph name to prevent a DoS through a     heap-based buffer over-read or possibly have unspecified     other impact via a crafted file (bsc#1028103)

  - CVE-2017-8105: Fix an out-of-bounds write caused by a     heap-based buffer overflow related to the     t1_decoder_parse_charstrings function in     psaux/t1decode.ca (bsc#1035807)

  - CVE-2017-8287: an out-of-bounds write caused by a     heap-based buffer overflow related to the     t1_builder_close_contour function in psaux/psobjs.c     (bsc#1036457)

  - Fix several integer overflow issues in     truetype/ttinterp.c (bsc#1079600)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

The remote host is affected by the vulnerability described in GLSA-201706-14 (FreeType: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FreeType. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to use a specially crafted font       file using FreeType, possibly resulting in execution of arbitrary code       with the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities were discovered in Freetype. Opening malformed fonts may result in denial of service or the execution of arbitrary code.

It was discovered that FreeType did not correctly handle certain malformed font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a possible heap buffer overflow.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was a denial of service vulnerability in freetype, a font rendering library.

The parse_charstrings function did not ensure that a font contains a glyph name, which allowed remote attackers to cause a denial of service via a specially crafted file.

For Debian 7 'Wheezy', this issue has been fixed in freetype version 2.4.9-1.1+deb7u4.

We recommend that you upgrade your freetype packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
134513	EulerOS Virtualization for ARM 64 3.0.2.0 : freetype (EulerOS-SA-2020-1224)	Nessus	Huawei Local Security Checks	critical
106896	SUSE SLES11 Security Update : freetype2 (SUSE-SU-2018:0462-1)	Nessus	SuSE Local Security Checks	critical
106747	SUSE SLED12 / SLES12 Security Update : freetype2 (SUSE-SU-2018:0414-1)	Nessus	SuSE Local Security Checks	critical
106743	openSUSE Security Update : freetype2 (openSUSE-2018-156)	Nessus	SuSE Local Security Checks	critical
100657	GLSA-201706-14 : FreeType: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
99742	Debian DSA-3839-1 : freetype - security update	Nessus	Debian Local Security Checks	critical
97854	Ubuntu 14.04 LTS / 16.04 LTS : FreeType vulnerability (USN-3237-1)	Nessus	Ubuntu Local Security Checks	high
97701	Fedora 24 : freetype (2017-3886afeb06)	Nessus	Fedora Local Security Checks	high
97682	Fedora 25 : freetype (2017-c09c0cc384)	Nessus	Fedora Local Security Checks	high
97588	Debian DLA-848-1 : freetype security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-10244

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

high

high

high

high