RHSA-2006:0500: freetype security update
First published: Tue Jul 18 2006(Updated: )
FreeType is a free, high-quality, and portable font engine.<br>Chris Evans discovered several integer underflow and overflow flaws in the<br>FreeType font engine. If a user loads a carefully crafted font file with a<br>program linked against FreeType, it could cause the application to crash or<br>execute arbitrary code as the user. While it is uncommon for a user to<br>explicitly load a font file, there are several application file formats<br>which contain embedded fonts that are parsed by FreeType. (CVE-2006-0747,<br>CVE-2006-1861, CVE-2006-3467)<br>A NULL pointer dereference flaw was found in the FreeType font engine. An<br>application linked against FreeType can crash upon loading a malformed font<br>file. (CVE-2006-2661)<br>Users of FreeType should upgrade to these updated packages, which contain<br>backported patches to correct these issues.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/freetype | <2.1.9-1.rhel4.4 | 2.1.9-1.rhel4.4 |
| redhat/freetype | <2.1.9-1.rhel4.4 | 2.1.9-1.rhel4.4 |
| redhat/freetype-demos | <2.1.9-1.rhel4.4 | 2.1.9-1.rhel4.4 |
| redhat/freetype-devel | <2.1.9-1.rhel4.4 | 2.1.9-1.rhel4.4 |
| redhat/freetype-utils | <2.1.9-1.rhel4.4 | 2.1.9-1.rhel4.4 |
| redhat/freetype-demos | <2.1.9-1.rhel4.4 | 2.1.9-1.rhel4.4 |
| redhat/freetype-devel | <2.1.9-1.rhel4.4 | 2.1.9-1.rhel4.4 |
| redhat/freetype-utils | <2.1.9-1.rhel4.4 | 2.1.9-1.rhel4.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of RHSA-2006:0500?
The severity of RHSA-2006:0500 is classified as moderate.
How do I fix RHSA-2006:0500?
To fix RHSA-2006:0500, upgrade to the FreeType version 2.1.9-1.rhel4.4 or later.
What are the impacts of RHSA-2006:0500?
The impacts of RHSA-2006:0500 can include application crashes or arbitrary code execution if a malicious font file is processed.
Which packages are affected by RHSA-2006:0500?
The affected packages include freetype, freetype-devel, freetype-utils, and freetype-demos in specific versions.
Is it safe to continue using systems with RHSA-2006:0500 vulnerability?
It is not safe to continue using systems with the RHSA-2006:0500 vulnerability as it can be exploited through malicious font files.
- collector/redhat-errata
- anchor-id/RHSA-2006:0500
- agent/references
- agent/title
- package-manager/redhat