FreeType TrueType Font Handling 'ttinterp.c' Remote Code Execution Vulnerability

Bugtraq ID:	44643
Class:	Unknown
CVE:	CVE-2010-3814
Remote:	Yes
Local:	No
Published:	Nov 04 2010 12:00AM
Updated:	Mar 19 2015 09:12AM
Credit:	Chris Evans
Vulnerable:	Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 ARM Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 SuSE SUSE Linux Enterprise Server 10 SP2 SuSE SUSE Linux Enterprise 10 SP4 SuSE SUSE Linux Enterprise 10 SP3 SuSE openSUSE 11.3 Sun Solaris 9_x86 Sun Solaris 9_sparc Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 11 Express Sun Solaris 10_x86 Sun Solaris 10_sparc S.u.S.E. openSUSE 11.2 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Gentoo Linux FreeType FreeType 2.4.3 FreeType FreeType 2.4.2 FreeType FreeType 2.4 FreeType FreeType 2.3.9 FreeType FreeType 2.3.6 FreeType FreeType 2.3.5 FreeType FreeType 2.3.4 FreeType FreeType 2.3.3 FreeType FreeType 2.2.10 FreeType FreeType 2.2.1 FreeType FreeType 2.1.10 FreeType FreeType 2.1.9 FreeType FreeType 2.1.7 FreeType FreeType 2.0.9 FreeType FreeType 2.0.6 FreeType FreeType 1.3.1 FreeType FreeType 2.3.11 FreeType FreeType 2.2 FreeType FreeType 0 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Avaya Interactive Response 4.0 Avaya CMS Server 16.2 Avaya CMS Server 16.1 Avaya CMS Server 16.0 Avaya CMS Server 15.0 AUX Avaya CMS Server 15.0 Apple Mac OS X Server 10.6.6 Apple Mac OS X Server 10.6.5 Apple Mac OS X Server 10.6.4 Apple Mac OS X Server 10.6.3 Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac OS X Server 10.5.8 Apple Mac OS X Server 10.5.7 Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5 Apple Mac OS X Server 10.6 Apple Mac OS X Server 10.5 Apple Mac OS X 10.6.5 Apple Mac OS X 10.6.4 Apple Mac OS X 10.6.3 Apple Mac OS X 10.6.2 Apple Mac OS X 10.6.1 Apple Mac OS X 10.5.8 Apple Mac OS X 10.5.7 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5 Apple Mac OS X 10.6 Apple Mac OS X 10.5 Apple iPod Touch 3.1.3 Apple iPod Touch 3.1.2 Apple iPod Touch 3.1.1 Apple iPod Touch 2.2.1 Apple iPod Touch 3.0 Apple iPod Touch 2.2 Apple iPod Touch 2.1 Apple iPhone 4.0.1 Apple iPhone 3.2.1 Apple iPhone 3.1.3 Apple iPhone 3.1.2 Apple iPhone 3.0.1 Apple iPhone 2.2.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 4.1 Apple iPhone 4.0 Apple iPhone 3.2 Apple iPhone 3.1 Apple iPhone 3.0 Apple iPhone 2.2 Apple iPhone 2.1 Apple iPhone 2.0 Apple iPad 3.2.1 Apple iPad 3.2.2 Apple iPad 3.2 Apple iPad 0 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 4.2 beta Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2
Not Vulnerable:	Apple Mac Os X Server 10.6.7 Apple iOS 4.2

FreeType TrueType Font Handling 'ttinterp.c' Remote Code Execution Vulnerability

FreeType is prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

FreeType TrueType Font Handling 'ttinterp.c' Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

FreeType TrueType Font Handling 'ttinterp.c' Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 9.10 powerpc

• Ubuntu freetype2-demos_2.3.9-5ubuntu0.4_powerpc.deb
  http://ports.ubuntu.com/pool/universe/f/freetype/freetype2-demos_2.3.9 -5ubuntu0.4_powerpc.deb


• Ubuntu libfreetype6-dev_2.3.9-5ubuntu0.4_powerpc.deb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6-dev_2.3.9-5u buntu0.4_powerpc.deb


• Ubuntu libfreetype6-udeb_2.3.9-5ubuntu0.4_powerpc.udeb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6-udeb_2.3.9-5 ubuntu0.4_powerpc.udeb


• Ubuntu libfreetype6_2.3.9-5ubuntu0.4_powerpc.deb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6_2.3.9-5ubunt u0.4_powerpc.deb

Ubuntu Ubuntu Linux 9.10 lpia

• Ubuntu freetype2-demos_2.3.9-5ubuntu0.4_lpia.deb
  http://ports.ubuntu.com/pool/universe/f/freetype/freetype2-demos_2.3.9 -5ubuntu0.4_lpia.deb


• Ubuntu libfreetype6-dev_2.3.9-5ubuntu0.4_lpia.deb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6-dev_2.3.9-5u buntu0.4_lpia.deb


• Ubuntu libfreetype6-udeb_2.3.9-5ubuntu0.4_lpia.udeb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6-udeb_2.3.9-5 ubuntu0.4_lpia.udeb


• Ubuntu libfreetype6_2.3.9-5ubuntu0.4_lpia.deb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6_2.3.9-5ubunt u0.4_lpia.deb

Ubuntu Ubuntu Linux 10.04 powerpc

• Ubuntu freetype2-demos_2.3.11-1ubuntu2.4_powerpc.deb
  http://ports.ubuntu.com/pool/universe/f/freetype/freetype2-demos_2.3.1 1-1ubuntu2.4_powerpc.deb


• Ubuntu libfreetype6-dev_2.3.11-1ubuntu2.4_powerpc.deb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6-dev_2.3.11-1 ubuntu2.4_powerpc.deb


• Ubuntu libfreetype6-udeb_2.3.11-1ubuntu2.4_powerpc.udeb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6-udeb_2.3.11- 1ubuntu2.4_powerpc.udeb


• Ubuntu libfreetype6_2.3.11-1ubuntu2.4_powerpc.deb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6_2.3.11-1ubun tu2.4_powerpc.deb

Ubuntu Ubuntu Linux 9.10 ARM

• Ubuntu freetype2-demos_2.3.9-5ubuntu0.4_armel.deb
  http://ports.ubuntu.com/pool/universe/f/freetype/freetype2-demos_2.3.9 -5ubuntu0.4_armel.deb


• Ubuntu libfreetype6-dev_2.3.9-5ubuntu0.4_armel.deb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6-dev_2.3.9-5u buntu0.4_armel.deb


• Ubuntu libfreetype6-udeb_2.3.9-5ubuntu0.4_armel.udeb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6-udeb_2.3.9-5 ubuntu0.4_armel.udeb


• Ubuntu libfreetype6_2.3.9-5ubuntu0.4_armel.deb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6_2.3.9-5ubunt u0.4_armel.deb

Ubuntu Ubuntu Linux 9.10 amd64

• Ubuntu freetype2-demos_2.3.9-5ubuntu0.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-d emos_2.3.9-5ubuntu0.4_amd64.deb


• Ubuntu libfreetype6-dev_2.3.9-5ubuntu0.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-de v_2.3.9-5ubuntu0.4_amd64.deb


• Ubuntu libfreetype6-udeb_2.3.9-5ubuntu0.4_amd64.udeb
  http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-ud eb_2.3.9-5ubuntu0.4_amd64.udeb


• Ubuntu libfreetype6_2.3.9-5ubuntu0.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2. 3.9-5ubuntu0.4_amd64.deb

Apple Mac OS X 10.6

• Apple MacOSXUpdCombo10.6.7.dmg
  For Mac OS X v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva lib64freetype6-2.3.7-1.6mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64freetype6-devel-2.3.7-1.6mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5

• Mandriva libfreetype6-2.3.7-1.6mdvmes5.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libfreetype6-devel-2.3.7-1.6mdvmes5.1.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu freetype2-demos_2.3.5-1ubuntu4.8.04.6_lpia.deb
  http://ports.ubuntu.com/pool/universe/f/freetype/freetype2-demos_2.3.5 -1ubuntu4.8.04.6_lpia.deb


• Ubuntu libfreetype6-dev_2.3.5-1ubuntu4.8.04.6_lpia.deb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6-dev_2.3.5-1u buntu4.8.04.6_lpia.deb


• Ubuntu libfreetype6-udeb_2.3.5-1ubuntu4.8.04.6_lpia.udeb
  http://ports.ubuntu.com/pool/universe/f/freetype/libfreetype6-udeb_2.3 .5-1ubuntu4.8.04.6_lpia.udeb


• Ubuntu libfreetype6_2.3.5-1ubuntu4.8.04.6_lpia.deb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6_2.3.5-1ubunt u4.8.04.6_lpia.deb

Mandriva Linux Mandrake 2009.0

• Mandriva libfreetype6-2.3.7-1.6mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libfreetype6-devel-2.3.7-1.6mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libfreetype6-static-devel-2.3.7-1.6mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 10.10 powerpc

• Ubuntu freetype2-demos_2.4.2-2ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/universe/f/freetype/freetype2-demos_2.4.2 -2ubuntu0.1_powerpc.deb


• Ubuntu libfreetype6-dev_2.4.2-2ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6-dev_2.4.2-2u buntu0.1_powerpc.deb


• Ubuntu libfreetype6-udeb_2.4.2-2ubuntu0.1_powerpc.udeb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6-udeb_2.4.2-2 ubuntu0.1_powerpc.udeb


• Ubuntu libfreetype6_2.4.2-2ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6_2.4.2-2ubunt u0.1_powerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu freetype2-demos_2.3.5-1ubuntu4.8.04.6_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-d emos_2.3.5-1ubuntu4.8.04.6_i386.deb


• Ubuntu libfreetype6-dev_2.3.5-1ubuntu4.8.04.6_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-de v_2.3.5-1ubuntu4.8.04.6_i386.deb


• Ubuntu libfreetype6-udeb_2.3.5-1ubuntu4.8.04.6_i386.udeb
  http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype 6-udeb_2.3.5-1ubuntu4.8.04.6_i386.udeb


• Ubuntu libfreetype6_2.3.5-1ubuntu4.8.04.6_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2. 3.5-1ubuntu4.8.04.6_i386.deb

Ubuntu Ubuntu Linux 9.10 sparc

• Ubuntu freetype2-demos_2.3.9-5ubuntu0.4_sparc.deb
  http://ports.ubuntu.com/pool/universe/f/freetype/freetype2-demos_2.3.9 -5ubuntu0.4_sparc.deb


• Ubuntu libfreetype6-dev_2.3.9-5ubuntu0.4_sparc.deb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6-dev_2.3.9-5u buntu0.4_sparc.deb


• Ubuntu libfreetype6-udeb_2.3.9-5ubuntu0.4_sparc.udeb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6-udeb_2.3.9-5 ubuntu0.4_sparc.udeb


• Ubuntu libfreetype6_2.3.9-5ubuntu0.4_sparc.deb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6_2.3.9-5ubunt u0.4_sparc.deb

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu freetype2-demos_2.3.5-1ubuntu4.8.04.6_powerpc.deb
  http://ports.ubuntu.com/pool/universe/f/freetype/freetype2-demos_2.3.5 -1ubuntu4.8.04.6_powerpc.deb


• Ubuntu libfreetype6-dev_2.3.5-1ubuntu4.8.04.6_powerpc.deb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6-dev_2.3.5-1u buntu4.8.04.6_powerpc.deb


• Ubuntu libfreetype6-udeb_2.3.5-1ubuntu4.8.04.6_powerpc.udeb
  http://ports.ubuntu.com/pool/universe/f/freetype/libfreetype6-udeb_2.3 .5-1ubuntu4.8.04.6_powerpc.udeb


• Ubuntu libfreetype6_2.3.5-1ubuntu4.8.04.6_powerpc.deb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6_2.3.5-1ubunt u4.8.04.6_powerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu freetype2-demos_2.3.5-1ubuntu4.8.04.6_sparc.deb
  http://ports.ubuntu.com/pool/universe/f/freetype/freetype2-demos_2.3.5 -1ubuntu4.8.04.6_sparc.deb


• Ubuntu libfreetype6-dev_2.3.5-1ubuntu4.8.04.6_sparc.deb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6-dev_2.3.5-1u buntu4.8.04.6_sparc.deb


• Ubuntu libfreetype6-udeb_2.3.5-1ubuntu4.8.04.6_sparc.udeb
  http://ports.ubuntu.com/pool/universe/f/freetype/libfreetype6-udeb_2.3 .5-1ubuntu4.8.04.6_sparc.udeb


• Ubuntu libfreetype6_2.3.5-1ubuntu4.8.04.6_sparc.deb
  http://ports.ubuntu.com/pool/main/f/freetype/libfreetype6_2.3.5-1ubunt u4.8.04.6_sparc.deb

Apple Mac OS X Server 10.6

• Apple MacOSXServerUpdCombo10.6.7.dmg
  For Mac OS X Server v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu freetype2-demos_2.3.5-1ubuntu4.8.04.6_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-d emos_2.3.5-1ubuntu4.8.04.6_amd64.deb


• Ubuntu libfreetype6-dev_2.3.5-1ubuntu4.8.04.6_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-de v_2.3.5-1ubuntu4.8.04.6_amd64.deb


• Ubuntu libfreetype6-udeb_2.3.5-1ubuntu4.8.04.6_amd64.udeb
  http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype 6-udeb_2.3.5-1ubuntu4.8.04.6_amd64.udeb


• Ubuntu libfreetype6_2.3.5-1ubuntu4.8.04.6_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2. 3.5-1ubuntu4.8.04.6_amd64.deb

Apple Mac OS X 10.5.8

• Apple SecUpd2011-001.dmg
  For Mac OS X v10.5.8
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.1

• Apple MacOSXUpdCombo10.6.7.dmg
  For Mac OS X v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.3

• Apple MacOSXUpdCombo10.6.7.dmg
  For Mac OS X v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.4

• Apple MacOSXUpdCombo10.6.7.dmg
  For Mac OS X v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.4

• Apple MacOSXServerUpdCombo10.6.7.dmg
  For Mac OS X Server v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.6

• Apple MacOSXServerUpd10.6.7.dmg
  For Mac OS X Server v10.6.6
  http://www.apple.com/support/downloads/

FreeType TrueType Font Handling 'ttinterp.c' Remote Code Execution Vulnerability

References:

• [truetype] Improve error handling of `SHZ' bytecode instruction. (Chris Evans)
  
• Buffer Overflow vulnerability in Freetype (Oracle)
  
• FreeType Homepage (FreeType)
  
• ASA-2012-106 Oracle Solaris Critical Update (CVE-2010-3814) (Avaya)
  
• Mandriva Linux Security Advisory MDVSA-2010:236 (Mandriva)