oss-security - Re: CVE Request -- FontForge: Stack-based buffer overflow by processing specially-crafted CHARSET

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1719938780.88521291323309685.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Thu, 2 Dec 2010 15:55:09 -0500 (EST)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Ulrik Persson <ddefrostt@...il.com>,
        "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE Request -- FontForge: Stack-based buffer
 overflow by processing specially-crafted CHARSET_REGISTRY font file header

Please use CVE-2010-4259 for this.

Thanks.

-- 
    JB


----- "Jan Lieskovsky" <jlieskov@...hat.com> wrote:

> Hello Steve, vendors,
> 
>    Ulrik Persson reported a stack-based buffer overflow
> flaw in the way FontForge font editor processed certain
> Bitmap Distribution Format (BDF) font files, with
> specially-crafted value of the CHARSET_REGISTRY header.
> A remote attacker could create a specially-crafted BDF
> font file and trick a local, unsuspecting user into
> opening it in FontForge, which could lead to fontforge
> executable crash or, potentially, arbitrary code execution
> with the privileges of the user running the executable.
> 
> References:
> [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=605537
> [2] https://bugzilla.redhat.com/show_bug.cgi?id=659359
> 
> Public PoC:
> [3]
> http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=fontforge-overflow.txt;att=1;bug=605537
> 
> Flaw severity note:
> On systems with compile time buffer checks (FORTIFY_SOURCE)
> feature enabled, the impact of this flaw is mitigated to
> be only crash.
> 
> Could you allocate a CVE id for this issue?
> 
> Thanks && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.