Hi Michel,
On 2025-03-13 22:54, Michel Lind wrote: The fixes I'm working with both the Meta security folks and the EL community (CentOS / AlmaLinux) can be tracked herehttps://gitlab.com/redhat/centos-stream/rpms/freetype/-/mergerequests/8/diffs
https://gitlab.freedesktop.org/freetype/freetype/-/commit/47103b2f195e0f9664c9470182f063cb7d41dc9f -- a/src/truetype/ttgload.c +++ b/src/truetype/ttgload.c @@ -1957,6 +1957,13 @@
limit = (short)gloader->current.numsubglyphs;
+ / make sure this isn't negative as we're going to add 4 later / + if ( limit < 0 ) + { + error = FTTHROW( InvalidArgument ); + goto Exit; + } + / construct an outline structure for / / communication with TTVaryApplyGlyphDeltas' / outline.npoints = (short)( gloader->current.numsubglyphs + 4 );
Marc.
I don't know much about this bug, which seems to have been announced by Facebook yesterday.
https://nvd.nist.gov/vuln/detail/CVE-2025-27363 An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild. The latest version of FreeType is 2.13.3 which is NOT affected, according to the announcement. Recent distro versions (e.g. Ubuntu 24.04 with 2.13.2) also look safe.
However, older distro versions seem to have affected libraries. For example Debian Bookworm has "2.12.1+dfsg-5+deb12u3", which is less than "2.13.0".
The bug would not be too concerning if people only used trusted fonts, as used to be routine. But webpages now embed fonts, and the affected "variable font files" format is widely used in browsers. It allows parametric adjustment of font properties, described here:
https://developer.mozilla.org/en-US/docs/Web/CSS/CSSfonts/Variablefontsguide
However, it looks like the browsers themselves might be embedding unaffected recent versions of FreeType. For example, I see Mozilla have a commit with the message: Bug 1912903 - Update freetype2 to 2.13.3. https://github.com/mozilla/gecko-dev/commit/026f6a947085020cd189dd9af3da00be433a44f8
I know there's some tension between bundling and unbundling tendencies in the packaging of browsers, so I am not sure how exposed anyone is.
Anyway, I don't see patches for 2.11.x and 2.12.x in stable/LTS releases, and the FreeType website seems pretty quiet about this.
Douglas
An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.
FreeType 2.8.1 has a signed integer overflow in cf2doFlex in cff/cf2intrp.c.
ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.
FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfntinitface.
FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNTSizeRequest.
FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FTRequestSize.
FreeType before 2.6.2 has a heap-based buffer over-read in ttcmap14validate in sfnt/ttcmap.c.
FreeType before 2.6.1 has a buffer over-read in skipcomment in psaux/psobjs.c because psparserskipPStoken is mishandled in an FTNewMemoryFace operation.
FreeType before 2.6.1 has a heap-based buffer over-read in T1GetPrivateDict in type1/t1parse.c.
In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1GetPrivateDict where there is no check that the new values of cur and limit are sensible before going to Again.
FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1builderclosecontour function in psaux/psobjs.c.
FreeType 2 before 2016-12-16 has an out-of-bounds write caused by a heap-based buffer overflow related to the cffparserrun function in cff/cffparse.c.
FreeType 2 before 2017-03-07 has an out-of-bounds write related to the TTGetMMVar function in truetype/ttgxvar.c and the sfntinitface function in sfnt/sfobjs.c.
FreeType 2 before 2017-03-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the TTGetMMVar function in truetype/ttgxvar.c and the sfntinitface function in sfnt/sfobjs.c.
FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the ttsizereset function in truetype/ttobjs.c.
The parsecharstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.
Stack-based buffer overflow in the cf2hintmapbuild function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of stem hints in a font file.
The bdfparseglyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to BDF fonts and an incorrect calculation that triggers an out-of-bounds read.
FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to BDF fonts and the improper handling of an "allocation error" in the bdffreefont function.
The bdfparseglyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) via vectors related to BDF fonts and an ENCODING field with a negative value.
An out-of heap-based buffer write flaw was found in the way TrueType bytecode / opcode interpreter of the FreeType font rendering engine performed moving of zone2 pointer point by execution of 'SHift Contour' (SHC) instruction. A remote attacker could provide a specially-crafted font file, which once opened in an application linked against FreeType would lead to that application crash, or, potentially arbitrary code execution with the privileges of the user running the application.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35689
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0fc8debeb6c2f6a8a9a2b97332a7c8a0a1bd9e85
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
An integer divide by zero was found in the way FreeType font rendering engine performed arithmetic computations for certain fonts. A remote attacker could provide a specially-crafted font file, which once opened in an application linked against FreeType would lead to that application crash.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35660
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=ba67957d5ead443f4b6b31805d6e780d54361ca4
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
An integer divide by zero was found in the way FreeType font rendering engine performed arithmetic computations for certain fonts. A remote attacker could provide a specially-crafted font file, which once opened in an application linked against FreeType would lead to that application crash.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35660
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=ba67957d5ead443f4b6b31805d6e780d54361ca4
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
An out-of heap-based buffer write flaw was found in the way FreeType font rendering engine performed computation of advance width values for certain glyph outlines. A remote attacker could provide a specially-crafted TrueType font file, which once opened in an application linked against FreeType would lead to that application crash, or, potentially arbitrary code execution with the privileges of the user running the application.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35659
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=7d35a7dc7cc621538a1f4a63c83ebf223aace0b0
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
An out-of heap-based buffer write flaw was found in the way FreeType font rendering engine performed computation of advance width values for certain glyph outlines. A remote attacker could provide a specially-crafted TrueType font file, which once opened in an application linked against FreeType would lead to that application crash, or, potentially arbitrary code execution with the privileges of the user running the application.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35659
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=7d35a7dc7cc621538a1f4a63c83ebf223aace0b0
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
An out-of heap-based buffer read flaw was found in the way FreeType font rendering engine performed conversion of ASCII string objects, contained within glyph bitmap distribution format (BDF) font file, into signed short integers. A remote attacker could provide a specially-crafted BDF file, which once processed by an application linked against FreeType would lead to that application crash.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35658
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=d9c1659610f9cd5e103790cb5963483d65cf0d2d
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.