An issue was discovered in FreeType 2 through 2.9. A NULL pointer dereference in the Ins_GETVARIATION() function within ttinterp.c could lead to DoS via a crafted font file.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - freetype: parse_charstrings function in type1/t1load.c does not ensure that a font contains a glyph name     (CVE-2016-10244)

  - An issue was discovered in FreeType 2 through 2.9. A NULL pointer dereference in the Ins_GETVARIATION()     function within ttinterp.c could lead to DoS via a crafted font file. (CVE-2018-6942)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - freetype: parse_charstrings function in type1/t1load.c does not ensure that a font contains a glyph name     (CVE-2016-10244)

  - An issue was discovered in FreeType 2 through 2.9. A NULL pointer dereference in the Ins_GETVARIATION()     function within ttinterp.c could lead to DoS via a crafted font file. (CVE-2018-6942)

  - FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation     violation via the function FT_Request_Size. (CVE-2022-27406)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn     by its CNA. Further investigation showed that it was not a security issue. Notes: none. (CVE-2023-2004)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - FreeType: Buffer overflow in sfnt_init_face (CVE-2022-27404)

  - The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font     contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-     read) or possibly have unspecified other impact via a crafted file. (CVE-2016-10244)

  - FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to     the t1_decoder_parse_charstrings function in psaux/t1decode.c. (CVE-2017-8105)

  - FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to     the t1_builder_close_contour function in psaux/psobjs.c. (CVE-2017-8287)

  - An issue was discovered in FreeType 2 through 2.9. A NULL pointer dereference in the Ins_GETVARIATION()     function within ttinterp.c could lead to DoS via a crafted font file. (CVE-2018-6942)

  - FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation     violation via the function FNT_Size_Request. (CVE-2022-27405)

  - FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation     violation via the function FT_Request_Size. (CVE-2022-27406)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn     by its CNA. Further investigation showed that it was not a security issue. Notes: none. (CVE-2023-2004)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for freetype2 to version 2.10.1 fixes the following issues :

Security issue fixed :

  - CVE-2018-6942: Fixed a NULL pointer dereference within     ttinerp.c (bsc#1079603).

Non-security issues fixed :

  - Update to version 2.10.1

  - The bytecode hinting of OpenType variation fonts was     flawed, since the data in the `CVAR' table wasn't     correctly applied.

  - Auto-hinter support for Mongolian.

  - The handling of the default character in PCF fonts as     introduced in version 2.10.0 was partially broken,     causing premature abortion of charmap iteration for many     fonts.

  - If `FT_Set_Named_Instance' was called with the same     arguments twice in a row, the function returned an     incorrect error code the second time.

  - Direct rendering using FT_RASTER_FLAG_DIRECT crashed     (bug introduced in version 2.10.0).

  - Increased precision while computing OpenType font     variation instances.

  - The flattening algorithm of cubic Bezier curves was     slightly changed to make it faster. This can cause very     subtle rendering changes, which aren't noticeable by the     eye, however.

  - The auto-hinter now disables hinting if there are blue     zones defined for a `style' (i.e., a certain combination     of a script and its related typographic features) but     the font doesn't contain any characters needed to set up     at least one blue zone.

  - Add tarball signatures and freetype2.keyring

  - Update to version 2.10.0

  - A bunch of new functions has been added to access and     process COLR/CPAL data of OpenType fonts with     color-layered glyphs.

  - As a GSoC 2018 project, Nikhil Ramakrishnan completely     overhauled and modernized the API reference.

  - The logic for computing the global ascender, descender,     and height of OpenType fonts has been slightly adjusted     for consistency.

  - `TT_Set_MM_Blend' could fail if called repeatedly with     the same arguments.

  - The precision of handling deltas in Variation Fonts has     been increased.The problem did only show up with     multidimensional designspaces.

  - New function `FT_Library_SetLcdGeometry' to set up the     geometry of LCD subpixels.

  - FreeType now uses the `defaultChar' property of PCF     fonts to set the glyph for the undefined character at     glyph index 0 (as FreeType already does for all other     supported font formats). As a consequence, the order of     glyphs of a PCF font if accessed with FreeType can be     different now compared to previous versions. This change     doesn't affect PCF font access with cmaps.

  - `FT_Select_Charmap' has been changed to allow parameter     value `FT_ENCODING_NONE', which is valid for BDF, PCF,     and Windows FNT formats to access built-in cmaps that     don't have a predefined `FT_Encoding' value.

  - A previously reserved field in the `FT_GlyphSlotRec'     structure now holds the glyph index.

  - The usual round of fuzzer bug fixes to better reject     malformed fonts.

  - `FT_Outline_New_Internal' and `FT_Outline_Done_Internal'     have been removed.These two functions were public by     oversight only and were never documented.

  - A new function `FT_Error_String' returns descriptions of     error codes if configuration macro     FT_CONFIG_OPTION_ERROR_STRINGS is defined.

  - `FT_Set_MM_WeightVector' and `FT_Get_MM_WeightVector'     are new functions limited to Adobe MultiMaster fonts to     directly set and get the weight vector.

  - Enable subpixel rendering with infinality config :

  - Re-enable freetype-config, there is just too many     fallouts. 

  - Update to version 2.9.1

  - Type 1 fonts containing flex features were not rendered     correctly (bug introduced in version 2.9).

  - CVE-2018-6942: Older FreeType versions can crash with     certain malformed variation fonts.

  - Bug fix: Multiple calls to `FT_Get_MM_Var' returned     garbage.

  - Emboldening of bitmaps didn't work correctly sometimes,     showing various artifacts (bug introduced in version     2.8.1).

  - The auto-hinter script ranges have been updated for     Unicode 11. No support for new scripts have been added,     however, with the exception of Georgian Mtavruli.

  - freetype-config is now deprecated by upstream and not     enabled by default.

  - Update to version 2.10.1

  - The `ftmulti' demo program now supports multiple hidden     axes with the same name tag.

  - `ftview', `ftstring', and `ftgrid' got a `-k' command     line option to emulate a sequence of keystrokes at     start-up.

  - `ftview', `ftstring', and `ftgrid' now support screen     dumping to a PNG file.

  - The bytecode debugger, `ttdebug', now supports variation     TrueType fonts; a variation font instance can be     selected with the new `-d' command line option.

  - Add tarball signatures and freetype2.keyring

  - Update to version 2.10.0

  - The `ftdump' demo program has new options `-c' and `-C'     to display charmaps in compact and detailed format,     respectively. Option `-V' has been removed.

  - The `ftview', `ftstring', and `ftgrid' demo programs use     a new command line option `-d' to specify the program     window's width, height, and color depth.

  - The `ftview' demo program now displays red boxes for     zero-width glyphs.

  - `ftglyph' has limited support to display fonts with     color-layered glyphs.This will be improved later on.

  - `ftgrid' can now display bitmap fonts also.

  - The `ttdebug' demo program has a new option `-f' to     select a member of a TrueType collection (TTC).

  - Other various improvements to the demo programs.

  - Remove 'Supplements: fonts-config' to avoid accidentally     pulling in Qt dependencies on some non-Qt based     desktops.(bsc#1091109) fonts-config is fundamental but     ft2demos seldom installs by end users. only fonts-config     maintainers/debuggers may use ft2demos along to debug     some issues. 

  - Update to version 2.9.1

  - No changelog upstream.

This update was imported from the SUSE:SLE-15:Update update project.

This update for freetype2 to version 2.10.1 fixes the following issues :

Security issue fixed :

CVE-2018-6942: Fixed a NULL pointer dereference within ttinerp.c (bsc#1079603).

Non-security issues fixed :

Update to version 2.10.1

  - The bytecode hinting of OpenType variation fonts was     flawed, since the data in the `CVAR' table wasn't     correctly applied.

  - Auto-hinter support for Mongolian.

  - The handling of the default character in PCF fonts as     introduced in version 2.10.0 was partially broken,     causing premature abortion of charmap iteration for many     fonts.

  - If `FT_Set_Named_Instance' was called with the same     arguments twice in a row, the function returned an     incorrect error code the second time.

  - Direct rendering using FT_RASTER_FLAG_DIRECT crashed     (bug introduced in version 2.10.0).

  - Increased precision while computing OpenType font     variation instances.

  - The flattening algorithm of cubic Bezier curves was     slightly changed to make it faster. This can cause very     subtle rendering changes, which aren't noticeable by the     eye, however.

  - The auto-hinter now disables hinting if there are blue     zones defined for a `style' (i.e., a certain combination     of a script and its related typographic features) but     the font doesn't contain any characters needed to set up     at least one blue zone.

Add tarball signatures and freetype2.keyring

Update to version 2.10.0

  - A bunch of new functions has been added to access and     process COLR/CPAL data of OpenType fonts with     color-layered glyphs.

  - As a GSoC 2018 project, Nikhil Ramakrishnan completely     overhauled and modernized the API reference.

  - The logic for computing the global ascender, descender,     and height of OpenType fonts has been slightly adjusted     for consistency.

  - `TT_Set_MM_Blend' could fail if called repeatedly with     the same arguments.

  - The precision of handling deltas in Variation Fonts has     been increased.The problem did only show up with     multidimensional designspaces.

  - New function `FT_Library_SetLcdGeometry' to set up the     geometry of LCD subpixels.

  - FreeType now uses the `defaultChar' property of PCF     fonts to set the glyph for the undefined character at     glyph index 0 (as FreeType already does for all other     supported font formats). As a consequence, the order of     glyphs of a PCF font if accessed with FreeType can be     different now compared to previous versions. This change     doesn't affect PCF font access with cmaps.

  - `FT_Select_Charmap' has been changed to allow parameter     value `FT_ENCODING_NONE', which is valid for BDF, PCF,     and Windows FNT formats to access built-in cmaps that     don't have a predefined `FT_Encoding' value.

  - A previously reserved field in the `FT_GlyphSlotRec'     structure now holds the glyph index.

  - The usual round of fuzzer bug fixes to better reject     malformed fonts.

  - `FT_Outline_New_Internal' and `FT_Outline_Done_Internal'     have been removed.These two functions were public by     oversight only and were never documented.

  - A new function `FT_Error_String' returns descriptions of     error codes if configuration macro     FT_CONFIG_OPTION_ERROR_STRINGS is defined.

  - `FT_Set_MM_WeightVector' and `FT_Get_MM_WeightVector'     are new functions limited to Adobe MultiMaster fonts to     directly set and get the weight vector.

Enable subpixel rendering with infinality config :

Re-enable freetype-config, there is just too many fallouts.

Update to version 2.9.1

  - Type 1 fonts containing flex features were not rendered     correctly (bug introduced in version 2.9).

  - CVE-2018-6942: Older FreeType versions can crash with     certain malformed variation fonts.

  - Bug fix: Multiple calls to `FT_Get_MM_Var' returned     garbage.

  - Emboldening of bitmaps didn't work correctly sometimes,     showing various artifacts (bug introduced in version     2.8.1).

  - The auto-hinter script ranges have been updated for     Unicode 11. No support for new scripts have been added,     however, with the exception of Georgian Mtavruli.

freetype-config is now deprecated by upstream and not enabled by default.

Update to version 2.10.1

  - The `ftmulti' demo program now supports multiple hidden     axes with the same name tag.

  - `ftview', `ftstring', and `ftgrid' got a `-k' command     line option to emulate a sequence of keystrokes at     start-up.

  - `ftview', `ftstring', and `ftgrid' now support screen     dumping to a PNG file.

  - The bytecode debugger, `ttdebug', now supports variation     TrueType fonts; a variation font instance can be     selected with the new `-d' command line option.

Add tarball signatures and freetype2.keyring

Update to version 2.10.0

  - The `ftdump' demo program has new options `-c' and `-C'     to display charmaps in compact and detailed format,     respectively. Option `-V' has been removed.

  - The `ftview', `ftstring', and `ftgrid' demo programs use     a new command line option `-d' to specify the program     window's width, height, and color depth.

  - The `ftview' demo program now displays red boxes for     zero-width glyphs.

  - `ftglyph' has limited support to display fonts with     color-layered glyphs.This will be improved later on.

  - `ftgrid' can now display bitmap fonts also.

  - The `ttdebug' demo program has a new option `-f' to     select a member of a TrueType collection (TTC).

  - Other various improvements to the demo programs.

Remove 'Supplements: fonts-config' to avoid accidentally pulling in Qt dependencies on some non-Qt based desktops.(bsc#1091109) fonts-config is fundamental but ft2demos seldom installs by end users. only fonts-config maintainers/debuggers may use ft2demos along to debug some issues.

Update to version 2.9.1

  - No changelog upstream.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the freetype2 package has been released.

Security fix for CVE-2018-6942.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that FreeType incorrectly handled certain files. An attacker could possibly use this to cause a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
196474	RHEL 5 : freetype (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196463	RHEL 6 : freetype (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196401	RHEL 7 : freetype (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
136887	openSUSE Security Update : freetype2 (openSUSE-2020-704)	Nessus	SuSE Local Security Checks	medium
136800	SUSE SLED15 / SLES15 Security Update : freetype2 (SUSE-SU-2020:1353-1)	Nessus	SuSE Local Security Checks	medium
121955	Photon OS 2.0: Freetype2 PHSA-2018-2.0-0058	Nessus	PhotonOS Local Security Checks	medium
121846	Photon OS 1.0: Freetype2 PHSA-2018-1.0-0148	Nessus	PhotonOS Local Security Checks	medium
106905	Fedora 27 : freetype (2018-07a3e36499)	Nessus	Fedora Local Security Checks	medium
106839	Ubuntu 17.10 : freetype vulnerability (USN-3572-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2018-6942

medium

Tenable Plugins

high

high

critical

medium

medium

medium

medium

medium

medium