An out-of heap-based buffer write flaw was found in the way TrueType bytecode / opcode interpreter of the FreeType font rendering engine performed moving of zone2 pointer point by execution of 'SHift Contour' (SHC) instruction. A remote attacker could provide a specially-crafted font file, which once opened in an application linked against FreeType would lead to that application crash, or, potentially arbitrary code execution with the privileges of the user running the application.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35689
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0fc8debeb6c2f6a8a9a2b97332a7c8a0a1bd9e85
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
An out-of heap-based buffer write flaw was found in the way FreeType font rendering engine performed computation of advance width values for certain glyph outlines. A remote attacker could provide a specially-crafted TrueType font file, which once opened in an application linked against FreeType would lead to that application crash, or, potentially arbitrary code execution with the privileges of the user running the application.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35659
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=7d35a7dc7cc621538a1f4a63c83ebf223aace0b0
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
An out-of heap-based buffer read flaw was found in the way FreeType font rendering engine performed conversion of ASCII string objects, contained within glyph bitmap distribution format (BDF) font file, into signed short integers. A remote attacker could provide a specially-crafted BDF file, which once processed by an application linked against FreeType would lead to that application crash.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35658
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=d9c1659610f9cd5e103790cb5963483d65cf0d2d
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
An array index error, leading to out-of stack-based buffer read flaw was found in the way FreeType font rendering engine processed certain glyph information for glyph bitmap distribution format (BDF) font files. A remote attacker could provide a specially-crafted BDF font file, which once opened in an application linked against FreeType would lead to that application crash.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35656
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=6ac022dc750d95296a6f731b9594f2e751d997fa
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
An out-of heap-based buffer read flaw was found in the way auxiliary PostScript driver of the FreeType font rendering engine performed conversion of certain PostScript font objects. A remote attacker could provide a specially-crafted PostScript font file, which once opened in an application linked against FreeType would lead to that application crash.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35657
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=292144b44a15c1a72f2ef76475d65b7a3a3fba67
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
An out-of heap-based buffer read flaw was found in the way TrueType bytecode / opcode interpreter of FreeType font rendering engine executed the 'Move Indirect Relative Point' (MIRP) instruction. A remote attacker could provide a specially-crafted font file, which once opened in an application linked against FreeType would lead to that application crash.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35646
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=a33c013fe2dc6e65de2879682201d9c155292349
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
An out-of heap-based buffer read flaw was found in the way FreeType font rendering engine performed loading and parsing of file header information for glyph bitmap distribution format (BDF) font files. A remote attacker could provide a BDF font file with specially-crafted BDF header, which once processed in an application linked against FreeType would lead to that application crash.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35643
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=cee5d593582801f65c5e127d9de9ca24ebcdc747
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
An out-of heap-based buffer write flaw was found in the way FreeType font rendering engine performed parsing of glyph and bitmaps information for glyph bitmap distribution format (BDF) font files, that were missing definition of the ENCODING field. A remote attacker could provide a specially-crafted BDF font file, which once opened in an application linked against FreeType would lead to that application crash, or, potentially arbitrary code execution with the privileges of the user running the application.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35641
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=4086fb7caf41e33137e548e43a49a97b127cd369
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
An out-of heap-based buffer write flaw was found in the way Type1 font parser of the FreeType font rendering engine retrieved private dictionar information for certain Type1 fonts. A remote attacker could provide a specially-crafted font file, which once opened in an application linked against FreeType would lead to that application crash, or, potentially, arbitrary code execution with the privileges of the user running the application.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35608
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=d9577add645c8c05460c7d60ad486c021394b82e
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
An out-of heap-based buffer read flaw was found in the way TrueType bytecode / opcode interpreter of the FreeType font rendering engine performed execution of NPUSHB and NPUSHW instructions. A remote attacker could provide a specially-crafted font file, which once opened in an application linked against FreeType would lead to that application crash.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35640
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=5dddcc45a03b336860436a180aec5b358517336b
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
An out-of heap-based buffer write flaw was found in the way FreeType font rendering engine performed parsing of glyph information and bitmaps for certain glyph bitmap distribution format (BDF) fonts. A remote attacker could provide a specially-crafted BDF font file, which once opened in an application linked against FreeType would lead to that application crash, or, potentially, arbitrary code execution with the privileges of the user running the application.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35607
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=28dd2c45957278e962f95633157b6139de8170aa
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
An out-of heap-based buffer read flaw was found in the way Type1 font loader of FreeType font rendering engine performed parsing of certain Type1 font dictionary entries. A remote attacker could provide a specially-crafted font file, which once opened in an application linked against FreeType would lead to that application crash.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35606
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=58cbc465d2ccd904dee755cff791fbb3a866646d
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
An out-of heap-based buffer read flaw was found in the way the anti-aliasing renderer of the FreeType font rendering engine processed certain TrueType fonts. A remote attacker could provide a specially-crafted TrueType font file, which once opened in an application linked against FreeType would lead to that application crash.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35604
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=fcbc82e69e7b114b0db75e955896107d611898e6
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
An out-of heap-based buffer read flaw was found in the way FreeType font rendering engine retrieved properties information from Portable Compiled Format (PCF) bitmap font files. A remote attacker could provide a specially-crafted PCF font file, which once opened in an application linked against FreeType would lead to that application crash.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35603
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=c776fc17bfeaa607405fc96620e9445e7a0965c3
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
An out-of heap-based buffer read flaw was found in the way Type42 font parser of the FreeType font rendering engine performed parsing of certain special font name table (SFNT) strings. A remote attacker could provide a specially-crafted font file, which once opened in an application linked against FreeType would lead to that application crash.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35602
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=82365c0dead99dd119d9e7117cf4f36ce1d1cbe1
A NULL pointer dereference flaw as found in the way TrueType bytecode interpreter of the FreeType font rendering engine performed movement of the zone2 pointer point for certain TrueType fonts. A remote attacker could provide a specially-crafted TrueType font file, which once opened in an application linked against FreeType would lead to that application crash.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35601
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=96cddb8d1d32d6738b06552083db9d6cee5b5cb4
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
An out-of heap-based buffer read flaw was found in the way FreeType font rendering engine performed parsing of glyph information and relevant bitmaps for glyph bitmap distribution format (BDF). A remote attacker could provide a specially-crafted BDF font file, which once opened in an application linked against FreeType would lead to that application crash.
Upstream bug reports: [1] https://savannah.nongnu.org/bugs/?35599 [2] https://savannah.nongnu.org/bugs/?35600
Upstream patch: [3] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0b1c0c6b20bf121096afff206d570f26183402b3
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
An out-of heap-based buffer read flaw was found in the way FreeType font rendering engine performed: 1) adding of properties, 2) parsing of properties, 3) checking if particular property is an atom
for Glyph bitmap distribution format (BDF) fonts. A remote attacker could provide a specially-crafted BDF font file, which once processed in an application linked against FreeType would lead to that application crash.
Upstream bug reports: [1] https://savannah.nongnu.org/bugs/?35597 [2] https://savannah.nongnu.org/bugs/?35598
Upstream patch: [3] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=320d4976d1d010b5abe9d61a7423d8ca06bc34df
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.