CVE-2012-1126: Buffer Overflow
An out-of heap-based buffer read flaw was found in the way FreeType font rendering engine performed: 1) adding of properties, 2) parsing of properties, 3) checking if particular property is an atom
for Glyph bitmap distribution format (BDF) fonts. A remote attacker could provide a specially-crafted BDF font file, which once processed in an application linked against FreeType would lead to that application crash.
Upstream bug reports: [1] https://savannah.nongnu.org/bugs/?35597 [2] https://savannah.nongnu.org/bugs/?35598
Upstream patch: [3] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=320d4976d1d010b5abe9d61a7423d8ca06bc34df
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
Other sources
FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via crafted property data in a BDF font.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1126?
CVE-2012-1126 has a severity rating of medium, indicating a moderate risk to affected systems.
How do I fix CVE-2012-1126?
To fix CVE-2012-1126, update FreeType to a version greater than 2.4.8 or apply any recommended patches.
What systems are affected by CVE-2012-1126?
CVE-2012-1126 affects FreeType versions including 1.3.1 up to 2.4.8.
Can CVE-2012-1126 be exploited remotely?
Yes, CVE-2012-1126 can be exploited remotely by an attacker using specially crafted font files.
What type of vulnerability is CVE-2012-1126?
CVE-2012-1126 is classified as an out-of-bounds read vulnerability within the FreeType font rendering engine.