Bug 46841

Summary:	freetype: Multiple issues (4.3)
Product:	UCS	Reporter:	Philipp Hahn <hahn>
Component:	Security updates	Assignee:	Philipp Hahn <hahn>
Status:	CLOSED DUPLICATE	QA Contact:	UCS maintainers <ucs-maintainers>
Severity:	normal
Priority:	P3	CC:	gohmann
Version:	UCS 4.3
Target Milestone:	UCS 4.3-0-errata
Hardware:	All
OS:	Linux
What kind of report is it?:	Security Issue	What type of bug is this?:	---
Who will be affected by this bug?:	---	How will those affected feel about the bug?:	---
User Pain:		Enterprise Customer affected?:
School Customer affected?:		ISV affected?:
Waiting Support:		Flags outvoted (downgraded) after PO Review:
Ticket number:		Bug group (optional):
Max CVSS v3 score:	7.0 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

Description Philipp Hahn

2018-04-17 14:48:40 CEST

New Debian freetype 2.5.2-3+deb8u2 fixes:
This update addresses the following issues:
* CVE-2016-10244: parse_charstrings function in type1/t1load.c does not
  ensure that a font contains a glyph name
* CVE-2017-8105: heap-based buffer overflow related to the
  t1_decoder_parse_charstrings
* CVE-2017-8287: heap-based buffer overflow related to the
  t1_builder_close_contour function

CVE-2016-10244 freetype: parse_charstrings function in type1/t1load.c does not ensure that a font contains a glyph name
CVE-2017-8105 freetype: heap-based buffer overflow related to the t1_decoder_parse_charstrings
CVE-2017-8287 freetype: heap-based buffer overflow related to the t1_builder_close_contour function

Comment 1 Philipp Hahn

2018-04-17 14:54:36 CEST


*** This bug has been marked as a duplicate of bug 44574 ***

Comment 2 Stefan Gohmann

2018-09-18 07:51:43 CEST

OK

Comment 3 Stefan Gohmann

2018-09-18 07:51:57 CEST

Nothing to release