FreeType TT_Load_Simple_Glyph() TTF File Integer Overflow Vulnerability
BID:24074
Info
FreeType TT_Load_Simple_Glyph() TTF File Integer Overflow Vulnerability
| Bugtraq ID: | 24074 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-2754 |
| Remote: | Yes |
| Local: | No |
| Published: | May 21 2007 12:00AM |
| Updated: | Apr 16 2015 05:50PM |
| Credit: | Victor Stinner is credited with discovering this issue. |
| Vulnerable: |
Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu Linux 6.10 sparc Ubuntu Ubuntu Linux 6.10 powerpc Ubuntu Ubuntu Linux 6.10 i386 Ubuntu Ubuntu Linux 6.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 8 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise Desktop 10 SP1 Sun StarSuite 8 Update 7 Sun StarSuite 8 Update 6 Sun StarSuite 8 Sun StarSuite 7.0 PP10 Sun StarSuite 7 PP9 Sun StarSuite 7 Sun StarSuite 6.0 PP7 Sun StarSuite 6 PP6 Sun StarSuite 6 Sun StarOffice 7.0 Sun StarOffice 8.0 Sun StarOffice 8 Update 7 Sun StarOffice 8 Update 6 Sun StarOffice 7.0 PP9 Sun StarOffice 7.0 PP10 Sun StarOffice 6.0 PP7 Sun StarOffice 6.0 PP6 Sun StarOffice 6.0 Sun Solaris 9_x86 Sun Solaris 9_sparc Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 10_x86 Sun Solaris 10_sparc SGI ProPack 3.0 SP6 S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux Standard Server 8.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. openSUSE 10.2 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Novell Linux POS 9 S.u.S.E. Novell Linux Desktop 9.0 S.u.S.E. Novell Linux Desktop 1.0 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 10.1 S.u.S.E. Linux Desktop 1.0 S.u.S.E. Linux 10.1 x86-64 S.u.S.E. Linux 10.1 x86 S.u.S.E. Linux 10.1 ppc S.u.S.E. Linux 10.0 x86-64 S.u.S.E. Linux 10.0 x86 S.u.S.E. Linux 10.0 ppc rPath rPath Linux 1 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux WS 3 RedHat Enterprise Linux WS 2.1 IA64 RedHat Enterprise Linux WS 2.1 RedHat Enterprise Linux ES 4 RedHat Enterprise Linux ES 3 RedHat Enterprise Linux ES 2.1 IA64 RedHat Enterprise Linux ES 2.1 RedHat Enterprise Linux Desktop Workstation 5 client RedHat Desktop 4.0 RedHat Desktop 3.0 RedHat Advanced Workstation for the Itanium Processor 2.1 Red Hat Fedora Core6 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux AS 3 Red Hat Enterprise Linux AS 2.1 IA64 Red Hat Enterprise Linux AS 2.1 Red Hat Enterprise Linux 5 Server Nortel Networks Self-Service Peri Workstation 0 Nortel Networks Self-Service Peri CTX 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service - CCSS7 0 Nortel Networks Multiservice Switch - MDM 0 Nortel Networks Media Processing Svr 500 Rel 3.0 Nortel Networks Media Processing Svr 1000 Rel 3.0 Nortel Networks Media Processing Svr 100 0 Nortel Networks Enterprise Network Management System Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Linux Terminal Server Project Linux Terminal Server Project 4.2 Gentoo Linux FreeType FreeType 2.3.4 FreeType FreeType 2.2.10 FreeType FreeType 2.2.1 FreeType FreeType 2.1.10 FreeType FreeType 2.1.9 FreeType FreeType 2.1.7 FreeType FreeType 2.0.9 FreeType FreeType 2.0.6 FreeType FreeType 1.3.1 FreeType FreeType 2.2 Foresight Linux Foresight Linux 1.1 DIA DIA 0.92.2 DIA DIA 0.88.1 DIA DIA 0.95-pre6 DIA DIA 0.95 DIA DIA 0.94 DIA DIA 0.93 DIA DIA 0.91 DIA DIA 0.87 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Avaya Voice Portal 4.1 Avaya Voice Portal 4.0 Avaya SES 2.0 Avaya Proactive Contact 3.0.2 Avaya Proactive Contact 4.1 Avaya Proactive Contact 4.0 Avaya Proactive Contact 3.0 Avaya Proactive Contact 0 Avaya Messaging Storage Server Avaya Message Networking MN 3.1 Avaya Message Networking 3.1 Avaya Message Networking Avaya Intuity AUDIX LX 2.0 SP2 Avaya Intuity AUDIX LX 2.0 SP1 Avaya Intuity AUDIX LX 2.0 Avaya Intuity AUDIX LX 1.0 Avaya Intuity LX 2.0 Avaya Intuity LX Avaya EMMC 1.017 Avaya Communication Manager 2.0.1 Avaya Communication Manager 2.0 Avaya Communication Manager 3.0 Avaya CCS 3.1.1 Avaya CCS 3.0 Avaya CCS 2.0 Avaya Aura SIP Enablement Services 3.1.1 Avaya Aura SIP Enablement Services 3.0 Avaya Aura Application Enablement Services 4.2.2 Avaya Aura Application Enablement Services 4.2.1 Avaya Aura Application Enablement Services 4.0.1 Avaya Aura Application Enablement Services 3.1.6 Avaya Aura Application Enablement Services 3.1.5 Avaya Aura Application Enablement Services 3.1.4 Avaya Aura Application Enablement Services 3.1.3 Avaya Aura Application Enablement Services 4.2 Avaya Aura Application Enablement Services 4.1 Avaya Aura Application Enablement Services 4.0 Avaya Aura Application Enablement Services 3.1 Avaya Aura Application Enablement Services 3.0 Apple Safari 3.0.3 Beta for Windows Apple Safari 3.0.2 Beta for Windows Apple Safari 3.0.1 Beta for Windows Apple Safari 3 Beta for Windows Apple Mac OS X Server 10.4.11 Apple Mac OS X Server 10.4.10 Apple Mac OS X Server 10.4.9 Apple Mac OS X Server 10.4.8 Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X 10.4.11 Apple Mac OS X 10.4.10 Apple Mac OS X 10.4.9 Apple Mac OS X 10.4.8 Apple Mac OS X 10.4.7 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 |
| Not Vulnerable: |
Linux Terminal Server Project Linux Terminal Server Project 5.0 DIA DIA 0.96.1-6 |
Discussion
FreeType TT_Load_Simple_Glyph() TTF File Integer Overflow Vulnerability
FreeType is prone to an integer-overflow vulnerability because it fails to properly validate TTF files.
An attacker may exploit this issue by enticing victims into opening maliciously crafted TTF Files.
Successful exploits will allow attackers to execute arbitrary code in the context in the context of applications that use the affected library. Failed exploit attempts will likely result in denial-of-service conditions.
This issue affects FreeType 2.3.4 and prior versions.
FreeType is prone to an integer-overflow vulnerability because it fails to properly validate TTF files.
An attacker may exploit this issue by enticing victims into opening maliciously crafted TTF Files.
Successful exploits will allow attackers to execute arbitrary code in the context in the context of applications that use the affected library. Failed exploit attempts will likely result in denial-of-service conditions.
This issue affects FreeType 2.3.4 and prior versions.
Exploit / POC
FreeType TT_Load_Simple_Glyph() TTF File Integer Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
FreeType TT_Load_Simple_Glyph() TTF File Integer Overflow Vulnerability
Solution:
The vendor has released a fix. Please see the references for more information.
Sun StarSuite 6 PP6
Ubuntu Ubuntu Linux 6.10 powerpc
Sun StarOffice 8 Update 7
Sun Solaris 8_sparc
Sun StarSuite 7
Sun StarOffice 6.0 PP7
Ubuntu Ubuntu Linux 7.04 i386
Sun StarOffice 7.0 PP10
Sun StarSuite 6.0 PP7
Ubuntu Ubuntu Linux 6.10 i386
Ubuntu Ubuntu Linux 7.04 amd64
Sun StarOffice 6.0
Ubuntu Ubuntu Linux 6.06 LTS i386
FreeType FreeType 1.3.1
Apple Mac OS X 10.4.11
Apple Mac OS X Server 10.4.11
FreeType FreeType 2.0.9
FreeType FreeType 2.1.7
SGI ProPack 3.0 SP6
Solution:
The vendor has released a fix. Please see the references for more information.
Sun StarSuite 6 PP6
-
Sun 112886-08
x86 Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -112886-08-1 -
Sun 112887-08
Linux Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -112887-08-1
Ubuntu Ubuntu Linux 6.10 powerpc
-
Ubuntu Updated packages for Ubuntu 6.10 source archive
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.2.1. o=rig.tar.gz
Sun StarOffice 8 Update 7
-
Sun 120184-10
Linux Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120184-10-1 -
Sun 120185-11
Sparc Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120185-11-1 -
Sun 120186-11
x86Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120186-11-1
Sun Solaris 8_sparc
Sun StarSuite 7
-
Sun 116518-14
Linux Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -116518-14-1 -
Sun 117073-12
x86 Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -117073-12-1
Sun StarOffice 6.0 PP7
-
Sun 112885-08
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -112885-08-1 -
Sun 112886-08
x86 Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -112886-08-1 -
Sun 112887-08
Linux Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -112887-08-1
Ubuntu Ubuntu Linux 7.04 i386
-
Ubuntu Updated packages for Ubuntu 7.04 source archive
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.2.1. o=rig.tar.gz
Sun StarOffice 7.0 PP10
-
Sun 116518-14
Linux Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -116518-14-1 -
Sun 116519-14
Sparc Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -116519-14-1 -
Sun 117073-12
x86 Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -117073-12-1
Sun StarSuite 6.0 PP7
-
Sun 112885-08
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -112885-08-1 -
Sun 112886-08
x86 Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -112886-08-1 -
Sun 112887-08
Linux Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -112887-08-1
Ubuntu Ubuntu Linux 6.10 i386
-
Ubuntu Updated packages for Ubuntu 6.10 source archive
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.2.1. o=rig.tar.gz
Ubuntu Ubuntu Linux 7.04 amd64
-
Ubuntu Updated packages for Ubuntu 7.04 source archive
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.2.1. o=rig.tar.gz
Sun StarOffice 6.0
-
Sun 112886-08
x86 Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -112886-08-1 -
Sun 112887-08
Linux Platform
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -112887-08-1
Ubuntu Ubuntu Linux 6.06 LTS i386
-
Ubuntu Updated packages for Ubuntu 6.06 LTS source archive
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.1.10 .=orig.tar.gz
FreeType FreeType 1.3.1
-
FreeType ttgload.c - 1.178
http://cvs.savannah.nongnu.org/viewvc/freetype2/src/truetype/ttgload.c ?root=freetype&r1=1.177&r2=1.178&view=patch
Apple Mac OS X 10.4.11
-
Apple SecUpd2009-002PPC.dmg
(PowerPC)
http://support.apple.com/downloads/DL818/SecUpd2009-002PPC.dmg
Apple Mac OS X Server 10.4.11
-
Apple SecUpd2009-002Intel.dmg
(Intel)
http://support.apple.com/downloads/DL817/SecUpd2009-002Intel.dmg -
Apple SecUpdSrvr2009-002PPC.dmg
(PowerPC)
http://support.apple.com/downloads/DL819/SecUpdSrvr2009-002PPC.dmg -
Apple SecUpdSrvr2009-002Univ.dmg
(Universal)
http://support.apple.com/downloads/DL816/SecUpdSrvr2009-002Univ.dmg
FreeType FreeType 2.0.9
-
FreeType ttgload.c - 1.178
http://cvs.savannah.nongnu.org/viewvc/freetype2/src/truetype/ttgload.c ?root=freetype&r1=1.177&r2=1.178&view=patch
FreeType FreeType 2.1.7
-
FreeType ttgload.c - 1.178
http://cvs.savannah.nongnu.org/viewvc/freetype2/src/truetype/ttgload.c ?root=freetype&r1=1.177&r2=1.178&view=patch
SGI ProPack 3.0 SP6
-
SGI Patch 10421
ftp://oss.sgi.com/projects/sgi_propack/download/
References
FreeType TT_Load_Simple_Glyph() TTF File Integer Overflow Vulnerability
References:
References:
- DIA Release Name: 0.96.1-6 (DIA)
- FreeType Homepage (FreeType)
- RHSA-2007:0403-4 - freetype security update (RedHat)
- Safari 3 Download Page (Apple)
- [ GLSA 200805-07 ] Linux Terminal Server Project: Multiple vulnerabilities (Robert Buchholz
) - ASA-2007-330 FreeType security update (RHSA-2007-0403) (Avaya)
- ASA-2009-226 freetype security update (RHSA-2009-0329) (Avaya)
- ASA-2009-243 freetype security update (RHSA-2009-1062) (Avaya)
- Nortel response to Sun Solaris Vulnerability in FreeType 2 Font Engine (Nortel Networks)
- Revision Log (Freetype)
- Sun Alert ID: 102967 Integer Overflow and Heap-Based Buffer Overflow Vulnerabili (Sun)
- Sun Alert ID: 103171 Security Vulnerability in FreeType 2 Font Engine May Allow (Sun)