[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <AANLkTiliVp55vqtftqHUd1VbwK2FpvsH3ud98ijKmsNr@mail.gmail.com>
Date: Tue, 13 Jul 2010 23:34:47 +0200
From: Robert Święcki <robert@...ecki.net>
To: oss-security@...ts.openwall.com
Subject: Multiple bugs in freetype
FYI
I've reported recently multiple problems in freetype (around ~20),
most of them are NULL-ptr derefs, stack exhaustion and div by zero
issues, but the rest might be interesting. RedHat was kind enough to
assign CVE numbers to some of them. vendor-sec members tend to treat
it as public issues, so reposting here:
> CVE-2010-2497 freetype integer underflow #30082 #30083
> CVE-2010-2498 freetype invalid free #30106
> CVE-2010-2499 freetype buffer overflow #30248 #30249
> CVE-2010-2500 freetype integer overflow #30263
> CVE-2010-2519 freetype heap buffer overflow #30306
> CVE-2010-2520 freetype buffer overflow on heap #30361
I wasn't trying to make weaponized exploits, although some of those
issues are clearly exploitable.
The full list
http://savannah.nongnu.org/bugs/index.php?group=freetype&func=browse&set=custom&report_id=101&submitted_by=78858
--
Robert Swiecki - http://www.swiecki.net
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
