REDHAT-BUG-800590
First published: Tue Mar 06 2012(Updated: )
An out-of heap-based buffer read flaw was found in the way Type1 font loader of FreeType font rendering engine performed parsing of certain Type1 font dictionary entries. A remote attacker could provide a specially-crafted font file, which once opened in an application linked against FreeType would lead to that application crash. Upstream bug report: [1] <a href="https://savannah.nongnu.org/bugs/?35606">https://savannah.nongnu.org/bugs/?35606</a> Upstream patch: [2] <a href="http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=58cbc465d2ccd904dee755cff791fbb3a866646d">http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=58cbc465d2ccd904dee755cff791fbb3a866646d</a> Acknowledgements: Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| FreeType |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://savannah.nongnu.org/bugs/?35606
- http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=58cbc465d2ccd904dee755cff791fbb3a866646d
- http://www.openwall.com/lists/oss-security/2012/03/06/16
- https://rhn.redhat.com/errata/RHSA-2012-0467.html
- https://bugzilla.redhat.com/show_bug.cgi?id=800590
Frequently Asked Questions
What is the severity of REDHAT-BUG-800590?
The severity of REDHAT-BUG-800590 is categorized as a potential security vulnerability due to a heap-based buffer read flaw.
How do I fix REDHAT-BUG-800590?
To fix REDHAT-BUG-800590, you should update the FreeType library to the latest patched version.
What is the impact of REDHAT-BUG-800590?
The impact of REDHAT-BUG-800590 is that a remote attacker could exploit the flaw through a specially-crafted font file to cause unexpected behavior in affected applications.
Which software is affected by REDHAT-BUG-800590?
The software affected by REDHAT-BUG-800590 is the FreeType font rendering engine.
Is there a workaround for REDHAT-BUG-800590?
Currently, there are no documented workarounds for REDHAT-BUG-800590, and updating FreeType is recommended.
- collector/redhat-bugzilla
- alias/CVE-2012-1132
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/references
- agent/severity
- agent/description
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/freetype
- canonical/freetype