LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Security Week: December 22nd, 2014
Linux Advisory Watch: December 19th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Mandriva: Subject: [Security Announce] [ MDVSA-2009:243 ] freetype2 Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Mandrake Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c. This update corrects the problem.
 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2009:243
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : freetype2
 Date    : September 22, 2009
 Affected: 2008.1, 2009.0, 2009.1, Corporate 3.0, Corporate 4.0,
           Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 Multiple integer overflows in FreeType 2.3.9 and earlier allow remote
 attackers to execute arbitrary code via vectors related to large
 values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c,
 and (3) cff/cffload.c.
 
 This update corrects the problem.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0946
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.1:
 d5813fc6271ea7cd76ab738f271c1c6a  2008.1/i586/libfreetype6-2.3.5-2.2mdv2008.1.i586.rpm
 c1d6a29ad9592d63362e224e2fa0ce9d  2008.1/i586/libfreetype6-devel-2.3.5-2.2mdv2008.1.i586.rpm
 46672c2a86d0ac243b1388a1e39a7943  2008.1/i586/libfreetype6-static-devel-2.3.5-2.2mdv2008.1.i586.rpm 
 bd4f836f5d6f1a596b4fb50a06e426a5  2008.1/SRPMS/freetype2-2.3.5-2.2mdv2008.1.src.rpm

 Mandriva Linux 2008.1/X86_64:
 fc6bd0f2a79571f953b02de4597b3ddf  2008.1/x86_64/lib64freetype6-2.3.5-2.2mdv2008.1.x86_64.rpm
 6f6fcaf9581327d76471ce65cbb65ce3  2008.1/x86_64/lib64freetype6-devel-2.3.5-2.2mdv2008.1.x86_64.rpm
 43dcd82a908ab2cd944f80f2dd498372  2008.1/x86_64/lib64freetype6-static-devel-2.3.5-2.2mdv2008.1.x86_64.rpm 
 bd4f836f5d6f1a596b4fb50a06e426a5  2008.1/SRPMS/freetype2-2.3.5-2.2mdv2008.1.src.rpm

 Mandriva Linux 2009.0:
 e675dac353da86d4b27d89f83d433d7c  2009.0/i586/libfreetype6-2.3.7-1.1mdv2009.0.i586.rpm
 fc323957e95386422436340b4a79a12f  2009.0/i586/libfreetype6-devel-2.3.7-1.1mdv2009.0.i586.rpm
 c7b9d6455335bb5bdd52134ddf077bfd  2009.0/i586/libfreetype6-static-devel-2.3.7-1.1mdv2009.0.i586.rpm 
 665da3ab3aa91a1305433eac968ac860  2009.0/SRPMS/freetype2-2.3.7-1.1mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 fe1d8dd6b394f7f9b01c2c182a02e3f5  2009.0/x86_64/lib64freetype6-2.3.7-1.1mdv2009.0.x86_64.rpm
 49ba1b9ba70693d3d967cd4841bf511f  2009.0/x86_64/lib64freetype6-devel-2.3.7-1.1mdv2009.0.x86_64.rpm
 7e94ab32121eead1da0ce0b2949ea78c  2009.0/x86_64/lib64freetype6-static-devel-2.3.7-1.1mdv2009.0.x86_64.rpm 
 665da3ab3aa91a1305433eac968ac860  2009.0/SRPMS/freetype2-2.3.7-1.1mdv2009.0.src.rpm

 Mandriva Linux 2009.1:
 e42b5e07235426f4e707648e8e4bf1d8  2009.1/i586/libfreetype6-2.3.9-1.1mdv2009.1.i586.rpm
 bd6793892e643b323be785cd97d9c86f  2009.1/i586/libfreetype6-devel-2.3.9-1.1mdv2009.1.i586.rpm
 475aa6ff9b332a3bd87da4de4b35cc7d  2009.1/i586/libfreetype6-static-devel-2.3.9-1.1mdv2009.1.i586.rpm 
 e63725b32587585dbe228f972e1e2380  2009.1/SRPMS/freetype2-2.3.9-1.1mdv2009.1.src.rpm

 Mandriva Linux 2009.1/X86_64:
 25b3e15ad48a854303030162b787db3a  2009.1/x86_64/lib64freetype6-2.3.9-1.1mdv2009.1.x86_64.rpm
 8440c7b2ae4e4a086cefe1fe2e6ff570  2009.1/x86_64/lib64freetype6-devel-2.3.9-1.1mdv2009.1.x86_64.rpm
 e27316a1f606abb8fc48777b8463ddb3  2009.1/x86_64/lib64freetype6-static-devel-2.3.9-1.1mdv2009.1.x86_64.rpm 
 e63725b32587585dbe228f972e1e2380  2009.1/SRPMS/freetype2-2.3.9-1.1mdv2009.1.src.rpm

 Corporate 3.0:
 f948c36866c4e88a57c2b86981cb0572  corporate/3.0/i586/libfreetype6-2.1.7-4.1mdk.i586.rpm
 e13e1f739ad2d23a8650b84b7c8a835e  corporate/3.0/i586/libfreetype6-devel-2.1.7-4.1mdk.i586.rpm
 3a51bd81a15f0ce1a8c9383cbb0f4303  corporate/3.0/i586/libfreetype6-static-devel-2.1.7-4.1mdk.i586.rpm 
 8a55e71067dec4650b2b87ced560df1f  corporate/3.0/SRPMS/freetype2-2.1.7-4.1mdk.src.rpm

 Corporate 3.0/X86_64:
 abb9d88c1a86f57a74de59ed7be92439  corporate/3.0/x86_64/lib64freetype6-2.1.7-4.1mdk.x86_64.rpm
 406752a5824f847e2e79a7df364400b6  corporate/3.0/x86_64/lib64freetype6-devel-2.1.7-4.1mdk.x86_64.rpm
 0a11ca2598811ea3682443ddc48516cf  corporate/3.0/x86_64/lib64freetype6-static-devel-2.1.7-4.1mdk.x86_64.rpm 
 8a55e71067dec4650b2b87ced560df1f  corporate/3.0/SRPMS/freetype2-2.1.7-4.1mdk.src.rpm

 Corporate 4.0:
 c7354faa30ceaf8ba7a4b9b1cc8ebac8  corporate/4.0/i586/libfreetype6-2.1.10-9.5.20060mdk.i586.rpm
 2e372e7929e098a2252625a68f796021  corporate/4.0/i586/libfreetype6-devel-2.1.10-9.5.20060mdk.i586.rpm
 700b134ae5e9be79d821d4fc1c3d4f62  corporate/4.0/i586/libfreetype6-static-devel-2.1.10-9.5.20060mdk.i586.rpm 
 851e39d15b46e39c0397843094404bec  corporate/4.0/SRPMS/freetype2-2.1.10-9.5.20060mdk.src.rpm

 Corporate 4.0/X86_64:
 2dac67bf3e415120ec46088c1f730cf6  corporate/4.0/x86_64/lib64freetype6-2.1.10-9.5.20060mdk.x86_64.rpm
 a8fdded81e8d96ece2df2bf04c1023ac  corporate/4.0/x86_64/lib64freetype6-devel-2.1.10-9.5.20060mdk.x86_64.rpm
 4868760c912eb7328149351fbb49ee2c  corporate/4.0/x86_64/lib64freetype6-static-devel-2.1.10-9.5.20060mdk.x86_64.rpm 
 851e39d15b46e39c0397843094404bec  corporate/4.0/SRPMS/freetype2-2.1.10-9.5.20060mdk.src.rpm

 Mandriva Enterprise Server 5:
 d4cb24a13958abfa18a879aa5b98172f  mes5/i586/libfreetype6-2.3.7-1.1mdvmes5.i586.rpm
 9d43b837f18818f660a4d03c608418fe  mes5/i586/libfreetype6-devel-2.3.7-1.1mdvmes5.i586.rpm
 400ba426ca88b7fbc408e3419b5d4881  mes5/i586/libfreetype6-static-devel-2.3.7-1.1mdvmes5.i586.rpm 
 ac2f712eef4f39dd3f0f755f6871bed8  mes5/SRPMS/freetype2-2.3.7-1.1mdvmes5.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 4d1ede220e16a886ac25133e77a65c38  mes5/x86_64/lib64freetype6-2.3.7-1.1mdvmes5.x86_64.rpm
 56208bca0368645b8956454fa0ea137f  mes5/x86_64/lib64freetype6-devel-2.3.7-1.1mdvmes5.x86_64.rpm
 7ff2a5b36638eb0891d92424f47263b4  mes5/x86_64/lib64freetype6-static-devel-2.3.7-1.1mdvmes5.x86_64.rpm 
 ac2f712eef4f39dd3f0f755f6871bed8  mes5/SRPMS/freetype2-2.3.7-1.1mdvmes5.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Weekend Edition
Report: U.S. planning “proportional response” to Sony hack, blamed on North Korea
Heartbleed, Shellshock, Tor and more: The 13 biggest security stories of 2014
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.