REDHAT-BUG-800583
First published: Tue Mar 06 2012(Updated: )
An out-of heap-based buffer read flaw was found in the way FreeType font rendering engine performed parsing of glyph information and relevant bitmaps for glyph bitmap distribution format (BDF). A remote attacker could provide a specially-crafted BDF font file, which once opened in an application linked against FreeType would lead to that application crash. Upstream bug reports: [1] <a href="https://savannah.nongnu.org/bugs/?35599">https://savannah.nongnu.org/bugs/?35599</a> [2] <a href="https://savannah.nongnu.org/bugs/?35600">https://savannah.nongnu.org/bugs/?35600</a> Upstream patch: [3] <a href="http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0b1c0c6b20bf121096afff206d570f26183402b3">http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0b1c0c6b20bf121096afff206d570f26183402b3</a> Acknowledgements: Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| FreeType |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://savannah.nongnu.org/bugs/?35599
- https://savannah.nongnu.org/bugs/?35600
- http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0b1c0c6b20bf121096afff206d570f26183402b3
- http://www.openwall.com/lists/oss-security/2012/03/06/16
- https://rhn.redhat.com/errata/RHSA-2012-0467.html
- https://bugzilla.redhat.com/show_bug.cgi?id=800583
- collector/redhat-bugzilla
- alias/CVE-2012-1127
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/description
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/freetype
- canonical/freetype