CVE-2022-27405

FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request.

FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request.

FreeType is written in C, designed to be small,efficient, highly customizable, and portable while capable of producing high-quality output (glyph images) of most vector and bitmap font formats

Security Fix(es):

FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face.(CVE-2022-27404)

FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request.(CVE-2022-27405)

FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size.(CVE-2022-27406)

FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType loads, hints, and renders individual glyphs efficiently.

Security Fix(es):

• FreeType: Buffer overflow in sfnt_init_face (CVE-2022-27404)

• FreeType: Segmentation violation via FNT_Size_Request (CVE-2022-27405)

• Freetype: Segmentation violation via FT_Request_Size (CVE-2022-27406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType loads, hints, and renders individual glyphs efficiently.

Security Fix(es):

• FreeType: Buffer overflow in sfnt_init_face (CVE-2022-27404)

• FreeType: Segmentation violation via FNT_Size_Request (CVE-2022-27405)

• Freetype: Segmentation violation via FT_Request_Size (CVE-2022-27406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.

FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request.

FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType loads, hints, and renders individual glyphs efficiently.

Security Fix(es):

• FreeType: Buffer overflow in sfnt_init_face (CVE-2022-27404)
• FreeType: Segmentation violation via FNT_Size_Request (CVE-2022-27405)
• Freetype: Segmentation violation via FT_Request_Size (CVE-2022-27406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType loads, hints, and renders individual glyphs efficiently.

Security Fix(es):

• FreeType: Buffer overflow in sfnt_init_face (CVE-2022-27404)
• FreeType: Segmentation violation via FNT_Size_Request (CVE-2022-27405)
• Freetype: Segmentation violation via FT_Request_Size (CVE-2022-27406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

In ft_open_face_internal of ftobjs.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

• CVE-2022-27404: Fix buffer overflow in sfnt_init_face
• CVE-2022-27405: Fix segmentation violation via FNT_Size_Request
• CVE-2022-27406: Fix segmentation violation via FT_Request_Size

• CVE-2022-27405: Fix segmentation violation via FNT_Size_Request
• CVE-2022-27406: Fix segmentation violation via FT_Request_Size

• CVE-2022-27405: Fix segmentation violation via FNT_Size_Request
• CVE-2022-27406: Fix segmentation violation via FT_Request_Size

FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request.

FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face. (CVE-2022-27404)

FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request. (CVE-2022-27405)

FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size. (CVE-2022-27406)

These are all security issues fixed in the libQt5Pdf5-5.15.11-1.1 package on the GA media of openSUSE Tumbleweed.

This update for freetype2 fixes the following issues:

• CVE-2022-27404 Fixed a segmentation fault via a crafted typeface (bsc#1198830).
• CVE-2022-27405 Fixed a buffer overflow via a crafted typeface (bsc#1198832).
• CVE-2022-27406 Fixed a segmentation fault via a crafted typeface (bsc#1198823).

Non-security fixes:

• Updated to version 2.10.4

This update for freetype2 fixes the following issues:

• CVE-2022-27404 Fixed a segmentation fault via a crafted typeface (bsc#1198830).
• CVE-2022-27405 Fixed a buffer overflow via a crafted typeface (bsc#1198832).
• CVE-2022-27406 Fixed a segmentation fault via a crafted typeface (bsc#1198823).

Non-security fixes:

• Updated to version 2.10.4

This update for freetype2 fixes the following issues:

Update to 2.13.2:

• Some fields in the FT_Outline structure have been changed from signed to unsigned type, which better reflects the actual usage. It is also an additional means to protect against malformed input.
• Rare double-free crashes in the cache subsystem have been fixed.
• Excessive stack allocation in the autohinter has been fixed.
• The B/W rasterizer has received a major upkeep that results in large performance improvements. The rendering speed has increased and even doubled for very complex glyphs.

It was discovered that FreeType did not correctly handle certain malformed font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash, or possibly execute arbitrary code.