-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDKSA-2006:099 http://www.mandriva.com/security/ _______________________________________________________________________ Package : freetype2 Date : June 12, 2006 Affected: 10.2, 2006.0, Corporate 3.0, Multi Network Firewall 2.0 _______________________________________________________________________ Problem Description: Integer underflow in Freetype before 2.2 allows remote attackers to cause a denial of service (crash) via a font file with an odd number of blue values, which causes the underflow when decrementing by 2 in a context that assumes an even number of values. (CVE-2006-0747) Multiple integer overflows in FreeType before 2.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attack vectors related to (1) bdf/bdflib.c, (2) sfnt/ttcmap.c, (3) cff/cffgload.c, and (4) the read_lwfn function and a crafted LWFN file in base/ftmac.c. (CVE-2006-1861) Ftutil.c in Freetype before 2.2 allows remote attackers to cause a denial of service (crash) via a crafted font file that triggers a null dereference. (CVE-2006-2661) In addition, a patch is applied to 2.1.10 in Mandriva 2006 to fix a serious bug in ttkern.c that caused some programs to go into an infinite loop when dealing with fonts that don't have a properly sorted kerning sub-table. This patch is not applicable to the earlier Mandriva releases. Packages have been patched to correct this issue. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0747 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1861 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2661 _______________________________________________________________________ Updated Packages: Mandriva Linux 10.2: 500d6a0363b912d3708164333618ea9a 10.2/RPMS/libfreetype6-2.1.9-6.1.102mdkmdk.i586.rpm 8dc7ea21f0c7485fb2e89722b61662e6 10.2/RPMS/libfreetype6-devel-2.1.9-6.1.102mdkmdk.i586.rpm 822d356b7df358d6fd33fdcba1ecce48 10.2/RPMS/libfreetype6-static-devel-2.1.9-6.1.102mdkmdk.i586.rpm 01fc46490cdad24a0ac7145ad1400fbe 10.2/SRPMS/freetype2-2.1.9-6.1.102mdkmdk.src.rpm Mandriva Linux 10.2/X86_64: 8bafa7103832649910ff29e46d3414da x86_64/10.2/RPMS/lib64freetype6-2.1.9-6.1.102mdkmdk.x86_64.rpm 116215379bbfe0cdf14cccce370fd74c x86_64/10.2/RPMS/lib64freetype6-devel-2.1.9-6.1.102mdkmdk.x86_64.rpm 01ce8b9853b9e509a7d8f034ff21cfb6 x86_64/10.2/RPMS/lib64freetype6-static-devel-2.1.9-6.1.102mdkmdk.x86_64.rpm 500d6a0363b912d3708164333618ea9a x86_64/10.2/RPMS/libfreetype6-2.1.9-6.1.102mdkmdk.i586.rpm 8dc7ea21f0c7485fb2e89722b61662e6 x86_64/10.2/RPMS/libfreetype6-devel-2.1.9-6.1.102mdkmdk.i586.rpm 822d356b7df358d6fd33fdcba1ecce48 x86_64/10.2/RPMS/libfreetype6-static-devel-2.1.9-6.1.102mdkmdk.i586.rpm 01fc46490cdad24a0ac7145ad1400fbe x86_64/10.2/SRPMS/freetype2-2.1.9-6.1.102mdkmdk.src.rpm Mandriva Linux 2006.0: 6068722811b9404d5aa08ee477987fb2 2006.0/RPMS/libfreetype6-2.1.10-9.2.20060mdk.i586.rpm 817917e69abb5674f646544308536419 2006.0/RPMS/libfreetype6-devel-2.1.10-9.2.20060mdk.i586.rpm dc4748e47335cc44243e39711c04def5 2006.0/RPMS/libfreetype6-static-devel-2.1.10-9.2.20060mdk.i586.rpm 6fbbc5e83a43e7c0b4c09593892ca554 2006.0/SRPMS/freetype2-2.1.10-9.2.20060mdk.src.rpm Mandriva Linux 2006.0/X86_64: 985900ddba982582ecb7d7eb51c20200 x86_64/2006.0/RPMS/lib64freetype6-2.1.10-9.2.20060mdk.x86_64.rpm afe093ac0ef65d5f5505f0c907d9c8dc x86_64/2006.0/RPMS/lib64freetype6-devel-2.1.10-9.2.20060mdk.x86_64.rpm 6f924308e4c1fe2da976a8d7905b9c45 x86_64/2006.0/RPMS/lib64freetype6-static-devel-2.1.10-9.2.20060mdk.x86_64.rpm 6068722811b9404d5aa08ee477987fb2 x86_64/2006.0/RPMS/libfreetype6-2.1.10-9.2.20060mdk.i586.rpm 817917e69abb5674f646544308536419 x86_64/2006.0/RPMS/libfreetype6-devel-2.1.10-9.2.20060mdk.i586.rpm dc4748e47335cc44243e39711c04def5 x86_64/2006.0/RPMS/libfreetype6-static-devel-2.1.10-9.2.20060mdk.i586.rpm 6fbbc5e83a43e7c0b4c09593892ca554 x86_64/2006.0/SRPMS/freetype2-2.1.10-9.2.20060mdk.src.rpm Corporate 3.0: ffb8fe54281b48ae7c8c0df2cdff4226 corporate/3.0/RPMS/libfreetype6-2.1.7-4.1.C30mdkmdk.i586.rpm 8160069b2aedc139d573d06786362b38 corporate/3.0/RPMS/libfreetype6-devel-2.1.7-4.1.C30mdkmdk.i586.rpm 3dc8f49900b644bdbed9c1ff87eab2e8 corporate/3.0/RPMS/libfreetype6-static-devel-2.1.7-4.1.C30mdkmdk.i586.rpm f3435422496277db7390cfc62ca58b3a corporate/3.0/SRPMS/freetype2-2.1.7-4.1.C30mdkmdk.src.rpm Corporate 3.0/X86_64: 86b12f1232fd54bcd76c59f9598a190d x86_64/corporate/3.0/RPMS/lib64freetype6-2.1.7-4.1.C30mdkmdk.x86_64.rpm db3ab38c85b3a39b848a499e4f2688c3 x86_64/corporate/3.0/RPMS/lib64freetype6-devel-2.1.7-4.1.C30mdkmdk.x86_64.rpm e689dbcd16c9541b6704c50a4c6e39c1 x86_64/corporate/3.0/RPMS/lib64freetype6-static-devel-2.1.7-4.1.C30mdkmdk.x86_64.rpm ffb8fe54281b48ae7c8c0df2cdff4226 x86_64/corporate/3.0/RPMS/libfreetype6-2.1.7-4.1.C30mdkmdk.i586.rpm f3435422496277db7390cfc62ca58b3a x86_64/corporate/3.0/SRPMS/freetype2-2.1.7-4.1.C30mdkmdk.src.rpm Multi Network Firewall 2.0: cd2ba6684b905ded5e1c41ea052d78d7 mnf/2.0/RPMS/libfreetype6-2.1.7-4.1.M20mdkmdk.i586.rpm 0b4bbd4fa79099031c2186f51a5defaa mnf/2.0/SRPMS/freetype2-2.1.7-4.1.M20mdkmdk.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) iD8DBQFEjZR8mqjQ0CJFipgRAlqyAKDo0jpzw3O4r7K0vxWZHaZhW/G2cgCfXxxA y37iNmlSTvUvcjj7v/C+NJA= =EFG5 -----END PGP SIGNATURE-----
