REDHAT-BUG-800598: Low severity FreeType vulnerability

Published Mar 6, 2012

Updated

An array index error, leading to out-of stack-based buffer read flaw was found in the way FreeType font rendering engine processed certain glyph information for glyph bitmap distribution format (BDF) font files. A remote attacker could provide a specially-crafted BDF font file, which once opened in an application linked against FreeType would lead to that application crash.

Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35656

Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=6ac022dc750d95296a6f731b9594f2e751d997fa

Acknowledgements:

Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.

Affected Software

1 affected component

FreeType

Event History

Mar 6, 2012

Data Sourced

06:56 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-800598?

The severity of REDHAT-BUG-800598 is categorized as high due to its potential for remote exploitation.

How do I fix REDHAT-BUG-800598?

To fix REDHAT-BUG-800598, update your FreeType package to the latest version recommended by your distribution.

What impact does REDHAT-BUG-800598 have on system security?

REDHAT-BUG-800598 can lead to information disclosure vulnerabilities allowing attackers to read out of stack memory.

Which software is affected by REDHAT-BUG-800598?

The affected software by REDHAT-BUG-800598 is the FreeType font rendering engine.

Can my system be compromised by REDHAT-BUG-800598?

Yes, if exploited, REDHAT-BUG-800598 can allow a remote attacker to execute an attack through crafted BDF font files.