CVE-2014-9667

Updated freetype2 packages fix security vulnerabilities:

The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType before 2.5.4 does not properly check for an integer overflow, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted OpenType font (CVE-2014-9656).

The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font (CVE-2014-9657).

The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font (CVE-2014-9658).

The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font (CVE-2014-9660).

type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font (CVE-2014-9661).

cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted OTF font (CVE-2014-9662).

The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table (CVE-2014-9663).

FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted Type42 font, related to type42/t42parse.c and type1/t1load.c (CVE-2014-9664).

The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted embedded bitmap (CVE-2014-9666).

sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted SFNT table (CVE-2014-9667).

Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have unspecified other impact via a crafted cmap SFNT table (CVE-2014-9669).

Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer overflow, NULL pointer dereference, and application crash) via a crafted PCF file that specifies negative values for the first column and first row (CVE-2014-9670).

Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PCF file with a 0xffffffff size value that is improperly incremented (CVE-2014-9671).

Array index error in the parse_fond function in…

These are all security issues fixed in the ft2demos-2.7-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the freetype2-devel-2.7-1.1 package on the GA media of openSUSE Tumbleweed.

freetype2 was updated to fix 20 security issues.

These security issues were fixed:

• CVE-2014-9663: The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, which allowed remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table (bnc#916865).
• CVE-2014-9662: cff/cf2ft.c in FreeType before 2.5.4 did not validate the return values of point-allocation functions, which allowed remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted OTF font (bnc#916860).
• CVE-2014-9661: type42/t42parse.c in FreeType before 2.5.4 did not consider that scanning can be incomplete without triggering an error, which allowed remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font (bnc#916859).
• CVE-2014-9660: The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 did not properly handle a missing ENDCHAR record, which allowed remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font (bnc#916858).
• CVE-2014-9667: sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allowed remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted SFNT table (bnc#916861).
• CVE-2014-9666: The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allowed remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted embedded bitmap (bnc#916862).
• CVE-2014-9665: The Load_SBit_Png function in sfnt/pngshim.c in FreeType before 2.5.4 did not restrict the rows and pitch values of PNG data, which allowed remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact by embedding a PNG file in a .ttf font file (bnc#916863).
• CVE-2014-9664: FreeType before 2.5.4 did not check for the end of the data during certain parsing actions, which allowed remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted Type42 font, related to type42/t42parse.c and type1/t1load.c (bnc#916864).
• CVE-2014-9669: Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allowed remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have unspecified other impact via a crafted cmap SFNT table (bnc#916870).
• CVE-2014-9668: The woff_open_font function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting length values, which allowed remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Web Open Font Format (WOFF) file (bnc#916868).
• CVE-2014-9656: The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType before 2.5.4 did not properly check for an integer overflow, which allowed remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted OpenType font (bnc#916847).
• CVE-2014-9658: The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allowed remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font (bnc#916857).
• CVE-2014-9659: cff/cf2intrp.c in the CFF CharString interpreter in FreeType…

The font rendering library freetype2 has been updated to fix various security issues.

Security Issues:

* CVE-2014-9656
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9656>
* CVE-2014-9657
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9657>
* CVE-2014-9658
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9658>
* CVE-2014-9660
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9660>
* CVE-2014-9661
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9661>
* CVE-2014-9662
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9662>
* CVE-2014-9667
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9667>
* CVE-2014-9666
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9666>
* CVE-2014-9665
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9665>
* CVE-2014-9664
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9664>
* CVE-2014-9663
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9663>
* CVE-2014-9659
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9659>
* CVE-2014-9668
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9668>
* CVE-2014-9669
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9669>
* CVE-2014-9670
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9670>
* CVE-2014-9671
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9671>
* CVE-2014-9672
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9672>
* CVE-2014-9673
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9673>
* CVE-2014-9674
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9674>
* CVE-2014-9675
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9675>

sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted SFNT table.

Mateusz Jurczyk discovered that FreeType did not correctly handle certain malformed font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash or possibly execute arbitrary code with user privileges.