Univention Bugzilla – Bug 40722
graphite2: Multiple issues (4.1)
Last modified: 2019-04-11 19:24:40 CEST
Upstream Debian package version 1.3.5-1~deb7u1 fixes these issues: * The directrun function in directmachine.cpp in Libgraphite in Graphite 2 does not validate a certain skip operation, which allows remote attackers to execute arbitrary code, obtain sensitive information, or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font. (CVE-2016-1521) * Code.cpp in Libgraphite in Graphite 2 does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font. (CVE-2016-1522) * The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font. (CVE-2016-1523) Note that UCS 4.0 shipped version 1.1.3. According the the Debian security tracker that version is affected too. Apparently the Debian package always pulls new upstream versions, there are no security-related patches in the fixed Debian package.
Upstream Debian package version 1.3.10-1~deb7u1 fixes: * Multiple vulnerabilities have been found in the Graphite font rendering engine which might result in denial of service or the execution of arbitrary code if a malformed font file is processed (CVE-2017-7771 CVE-2017-7772 CVE-2017-7773 CVE-2017-7774 CVE-2017-7775 CVE-2017-7776 CVE-2017-7777 CVE-2017-7778)
This issue has been filed against UCS 4.1. UCS 4.1 is out of maintenance and many UCS components have vastly changed in later releases. Thus, this issue is now being closed. If this issue still occurs in newer UCS versions, please use "Clone this bug" or reopen this issue. In this case please provide detailed information on how this issue is affecting you.