FreeType Versions Prior to 2.5.4 Multiple Remote Vulnerabilities

Bugtraq ID:	72986
Class:	Unknown
CVE:	CVE-2014-9668 CVE-2014-9669 CVE-2014-9674 CVE-2014-9675 CVE-2014-9670 CVE-2014-9671 CVE-2014-9657 CVE-2014-9673 CVE-2014-9658 CVE-2014-9672 CVE-2014-9664 CVE-2014-9665 CVE-2014-9666 CVE-2014-9667 CVE-2014-9660 CVE-2014-9661 CVE-2014-9662 CVE-2014-9663 CVE-2014-9656
Remote:	Yes
Local:	No
Published:	Mar 09 2015 12:00AM
Updated:	Nov 24 2016 01:10AM
Credit:	Mateusz Jurczyk of Google Security Team.
Vulnerable:	Ubuntu Ubuntu Linux 14.10 Ubuntu Ubuntu Linux 14.04 LTS Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 IBM Security Privileged Identity Manager 2.0.1 IBM Security Privileged Identity Manager 2.0 IBM Security Privileged Identity Manager 1.0.1.1 IBM Security Privileged Identity Manager 1.0.1 IBM Security Access Manager for Web 8.0.1 IBM Security Access Manager for Web 8.0 3 IBM Security Access Manager for Web 8.0 2 IBM Security Access Manager for Web 8.0.1.2 IBM Security Access Manager for Web 8.0.1.1 IBM Security Access Manager for Web 8.0.1.0 IBM Security Access Manager for Web 8.0.0.5 IBM Security Access Manager for Web 8.0.0.4 IBM Security Access Manager for Web 8.0 IBM Security Access Manager for Web 7.0 IBM Security Access Manager for Mobile 8.0.1 IBM Security Access Manager for Mobile 8.0.1.2 IBM Security Access Manager for Mobile 8.0.1.1 IBM Security Access Manager for Mobile 8.0.0.5 IBM Security Access Manager for Mobile 8.0.0.4 IBM Security Access Manager for Mobile 8.0.0.3 IBM Security Access Manager for Mobile 8.0.0.1 IBM Security Access Manager for Mobile 8.0.0.0 IBM Security Access Manager for Mobile 8.0 IBM Flex System Manager 1.3.2 0 IBM Flex System Manager 1.3.4.0 IBM Flex System Manager 1.3.3.0 Google Android 6.0.1 Google Android 5.1.1 Google Android 5.0.2 Google Android 4.4.4 Google Android 6.0 Gentoo Linux FreeType FreeType 2.4.12 FreeType FreeType 2.4.7 FreeType FreeType 2.4.5 FreeType FreeType 2.4.3 FreeType FreeType 2.4.2 FreeType FreeType 2.4 FreeType FreeType 2.3.9 FreeType FreeType 2.3.6 FreeType FreeType 2.3.5 FreeType FreeType 2.3.4 FreeType FreeType 2.3.3 FreeType FreeType 2.2.10 FreeType FreeType 2.2.1 FreeType FreeType 2.1.10 FreeType FreeType 2.1.9 FreeType FreeType 2.1.7 FreeType FreeType 2.0.9 FreeType FreeType 2.0.6 FreeType FreeType 1.3.1 FreeType FreeType 2.5.3 FreeType FreeType 2.5.2 FreeType FreeType 2.5.1 FreeType FreeType 2.5 FreeType FreeType 2.4.9 FreeType FreeType 2.4.8 FreeType FreeType 2.4.6 FreeType FreeType 2.4.4 FreeType FreeType 2.4.11 FreeType FreeType 2.4.10 FreeType FreeType 2.4.1 FreeType FreeType 2.3.8 FreeType FreeType 2.3.7 FreeType FreeType 2.3.2 FreeType FreeType 2.3.12 FreeType FreeType 2.3.11 FreeType FreeType 2.3.10 FreeType FreeType 2.3.1 FreeType FreeType 2.3.0 FreeType FreeType 2.2 FreeType FreeType 2.2 FreeType FreeType 2.1.8 FreeType FreeType 2.1.6 FreeType FreeType 2.1.5 FreeType FreeType 2.1.4 FreeType FreeType 2.1.3 FreeType FreeType 2.0.8 FreeType FreeType 2.0.7 FreeType FreeType 2.0.5 FreeType FreeType 2.0.4 FreeType FreeType 2.0.3 FreeType FreeType 2.0.2 FreeType FreeType 2.0.1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CentOS CentOS 6 Avaya Session Border Controller for Enterprise 6.3.0 Avaya one-X Client Enablement Services 6.2 SP2 Avaya one-X Client Enablement Services 6.2 Avaya IP Office Server Edition 9.0 Avaya IP Office Server Edition 8.1 Avaya IP Office Application Server 9.0 SP 2 Avaya IP Office Application Server 9.0 SP 1 Avaya IP Office Application Server 9.0 Avaya CMS r17 Avaya CMS R16.3eg.g Avaya CMS R16.3eg.e Avaya CMS R16.3 R7 Avaya CMS R16.3 R6 Avaya CMS R16.3 Avaya Aura Experience Portal 6.0.2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 7.0 Avaya Aura Experience Portal 6.0 SP2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0 SP1 Avaya Aura Experience Portal 6.0 Avaya Aura Conferencing 8.0 SP2 Avaya Aura Conferencing 8.0 SP1 Avaya Aura Conferencing 8.0
Not Vulnerable:	FreeType FreeType 2.5.4

FreeType Versions Prior to 2.5.4 Multiple Remote Vulnerabilities

FreeType is prone to the following vulnerabilities:

1. Multiple integer-overflow vulnerabilities
2. Multiple heap-based buffer-overflow vulnerabilities
3. An information-disclosure vulnerability
4. Multiple denial-of-service vulnerabilities

Remote attackers can exploit these issues to obtain sensitive information and execute arbitrary code in the context of the application or cause denial-of-service conditions.

FreeType versions prior to 2.5.4 are vulnerable.

FreeType Versions Prior to 2.5.4 Multiple Remote Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

FreeType Versions Prior to 2.5.4 Multiple Remote Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

FreeType Versions Prior to 2.5.4 Multiple Remote Vulnerabilities

References:

• Bug 15332 - freetype2 several security issues fixed upstream in 2.5.4 (Mageia Bugzilla)
  
• FreeType Homepage (FreeType)
  
• freetype: many vulnerabilities (Mateusz Jurczyk)
  
• Android Security Bulletin�??November 2016 (Google)
  
• freetype security update (RHSA-2015-0696) (Avaya)
  
• Oracle Solaris Third Party Bulletin CVE-2014-9663 (Avaya)
  
• Security Bulletin: IBM Flex System Manager (FSM) is affected by multiple freetyp (IBM)
  
• Security Bulletin: Multiple Security Vulnerabilities Fixed in IBM Security Privi (IBM)
  
• Security Bulletin: Multiple vulnerabilities in FreeType library affect IBM Secur (IBM)
  
• Security Bulletin: Multiple vulnerabilities in the FreeType library affect IBM S (IBM)