oss-security - Re: Multiple bugs in freetype

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2060260017.430061279129531508.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Wed, 14 Jul 2010 13:45:31 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: coley <coley@...re.org>
Subject: Re: Multiple bugs in freetype

I'm also adding a CVE id for the buffer overflows in the freetype demo programs:

CVE-2010-2527
http://savannah.nongnu.org/bugs/index.php?30054

The fix is here:
http://git.savannah.gnu.org/cgit/freetype/freetype2-demos.git/commit/?id=b995299b73ba4cd259f221f500d4e63095508bec

Thanks.

-- 
    JB



----- "Robert Święcki" <robert@...ecki.net> wrote:

> FYI
> 
> I've reported recently multiple problems in freetype (around ~20),
> most of them are NULL-ptr derefs, stack exhaustion and div by zero
> issues, but the rest might be interesting. RedHat was kind enough to
> assign CVE numbers to some of them. vendor-sec members tend to treat
> it as public issues, so reposting here:
> 
> > CVE-2010-2497 freetype integer underflow #30082 #30083
> > CVE-2010-2498 freetype invalid free #30106
> > CVE-2010-2499 freetype buffer overflow #30248 #30249
> > CVE-2010-2500 freetype integer overflow #30263
> > CVE-2010-2519 freetype heap buffer overflow #30306
> > CVE-2010-2520 freetype buffer overflow on heap #30361
> 
> I wasn't trying to make weaponized exploits, although some of those
> issues are clearly exploitable.
> 
> The full list
> 
> http://savannah.nongnu.org/bugs/index.php?group=freetype&func=browse&set=custom&report_id=101&submitted_by=78858
> 
> -- 
> Robert Swiecki - http://www.swiecki.net

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.