RHSA-2006:0500: freetype security update

First published: Tue Jul 18 2006(Updated: )

FreeType is a free, high-quality, and portable font engine.<br>Chris Evans discovered several integer underflow and overflow flaws in the<br>FreeType font engine. If a user loads a carefully crafted font file with a<br>program linked against FreeType, it could cause the application to crash or<br>execute arbitrary code as the user. While it is uncommon for a user to<br>explicitly load a font file, there are several application file formats<br>which contain embedded fonts that are parsed by FreeType. (CVE-2006-0747,<br>CVE-2006-1861, CVE-2006-3467)<br>A NULL pointer dereference flaw was found in the FreeType font engine. An<br>application linked against FreeType can crash upon loading a malformed font<br>file. (CVE-2006-2661)<br>Users of FreeType should upgrade to these updated packages, which contain<br>backported patches to correct these issues.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-errata
• anchor-id/RHSA-2006:0500
• agent/references
• agent/title
• package-manager/redhat