https://bugzilla.redhat.com/show_bug.cgi?id=1049569
Bug ID: 1049569
Summary: CVE-2013-6462 libXfont: stack-based buffer overflow
flaw when parsing Glyph Bitmap Distribution Format
(BDF) fonts [fedora-all]
Product: Fedora
Version: 20
Component: libXfont
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: sandmann(a)redhat.com
Reporter: vdanen(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: fonts-bugs(a)lists.fedoraproject.org,
sandmann(a)redhat.com
Blocks: 1048044 (CVE-2013-6462)
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: this issue affects multiple supported versions of Fedora.
Only one tracking bug has been filed; please ensure that it is only closed
when all affected versions are fixed.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1048044
[Bug 1048044] CVE-2013-6462 libXfont: stack-based buffer overflow flaw when
parsing Glyph Bitmap Distribution Format (BDF) fonts
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=tBX4tz6Dc3&a=cc_unsubscribe
https://bugs.webkit.org/show_bug.cgi?id=22621
Summary: RFE: Add font autoinstallation support
Product: WebKit
Version: 528+ (Nightly build)
Platform: PC
OS/Version: Linux
Status: UNCONFIRMED
Severity: Enhancement
Priority: P2
Component: Text
AssignedTo: webkit-unassigned(a)lists.webkit.org
ReportedBy: nicolas.mailhot(a)laposte.net
CC: fedora-fonts-bugs-list(a)redhat.com
The Linux platform is gaining an on-demand font autoinstallation framework (BSD
and Solaris will probably follow eventually).
http://fedoraproject.org/wiki/Features/AutomaticFontInstallation
Webkit browsers should be plugged into it and use it to request the fonts the
pages they render need. This would have a huge user impact, especially for
pages that have strong i18n constrains.
Unlike proposals such as @font-face and EOT the fonts are sourced from trusted
user-controlled sources, are properly vetted legal-side, use the latest font
versions not old obsolete ones (with bug fixes), and are installed system-wide
where other apps can take advantage of them.
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.redhat.com/show_bug.cgi?id=1074647
Bug ID: 1074647
Summary: CVE-2014-2240 freetype: OOB stack-based read/write in
cf2_hintmap_build() [fedora-20]
Product: Fedora
Version: 20
Component: freetype
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: mkasik(a)redhat.com
Reporter: vdanen(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: behdad(a)fedoraproject.org,
fonts-bugs(a)lists.fedoraproject.org,
kevin(a)tigcc.ticalc.org, mkasik(a)redhat.com
Blocks: 1074646 (CVE-2014-2240)
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
fedora-20 tracking bug for freetype: see blocks bug list for full details of
the security issue(s).
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1074646
[Bug 1074646] CVE-2014-2240 freetype: OOB stack-based read/write in
cf2_hintmap_build()
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=v4fZcfKSM8&a=cc_unsubscribe
https://bugzilla.redhat.com/show_bug.cgi?id=1023977
Bug ID: 1023977
Summary: Use fc-cache /usr/share/fonts/<your font directory>
instead of /usr/share/fonts
Product: Red Hat Enterprise Linux 7
Version: 7.0
Component: ghostscript-fonts
Assignee: twaugh(a)redhat.com
Reporter: twaugh(a)redhat.com
QA Contact: qe-i18n-bugs(a)redhat.com
CC: fonts-bugs(a)lists.fedoraproject.org,
patrick.noffke(a)gmail.com, tagoh(a)redhat.com,
twaugh(a)redhat.com
Depends On: 1021757
Group: redhat
+++ This bug was initially created as a clone of Bug #1021757 +++
Description of problem:
Running fc-cache with /usr/share/fonts takes too much time and may breaks the
cache for parents when installing multiple font packages or upgrading
fontconfig, especially sometimes happens on the installation say.
As the macro in fontpackages does, please follow it up and use fc-cache
/usr/share/fonts/<your font directory> instead of /usr/share/fonts.
Version-Release number of selected component (if applicable):
ghostscript-fonts-5.50-30.fc19.noarch
How reproducible:
always
Steps to Reproduce:
1.rpm -q --scripts ghostscript-fonts-5.50-30.fc19.noarch
2.
3.
Actual results:
postinstall scriptlet (using /bin/sh):
{
mkfontscale /usr/share/fonts/default/ghostscript
mkfontdir /usr/share/fonts/default/ghostscript
fc-cache /usr/share/fonts
} &> /dev/null || :
postuninstall scriptlet (using /bin/sh):
{
if [ "$1" = "0" ]; then
fc-cache /usr/share/fonts
fi
} &> /dev/null || :
Expected results:
the directory should be /usr/share/fonts/<your font directory> instead
Additional info:
--- Additional comment from Tim Waugh on 2013-10-22 04:51:41 EDT ---
For the postuninstall scriptlet too?
Is there anything planned for the Fedora Project packaging guidelines to make
sure there are no regressions with this?
Does this change look correct?:
diff --git a/ghostscript-fonts.spec b/ghostscript-fonts.spec
index d66fbaa..c2cbc3f 100644
--- a/ghostscript-fonts.spec
+++ b/ghostscript-fonts.spec
@@ -1,7 +1,7 @@
Summary: Fonts for the Ghostscript PostScript interpreter
Name: ghostscript-fonts
Version: 5.50
-Release: 30%{?dist}
+Release: 31%{?dist}
# Contacted Kevin Hartig, who agreed to relicense his fonts under the SIL Open
Font
# License. Hershey fonts are under the "Hershey Font License", which is not
what Fontmap
# says (Fontmap is wrong).
@@ -58,13 +58,13 @@ ln -sf %{fontdir}
$RPM_BUILD_ROOT%{catalogue}/default-ghostscript
{
mkfontscale %{fontdir}
mkfontdir %{fontdir}
- fc-cache %{_datadir}/fonts
+ fc-cache %{fontdir}
} &> /dev/null || :
%postun
{
if [ "$1" = "0" ]; then
- fc-cache %{_datadir}/fonts
+ fc-cache %{fontdir}
fi
} &> /dev/null || :
@@ -80,6 +80,10 @@ rm -rf $RPM_BUILD_ROOT
%ghost %verify(not md5 size mtime) %{fontdir}/fonts.scale
%changelog
+* Tue Oct 22 2013 Tim Waugh <twaugh(a)redhat.com> - 5.50-31
+- Run fc-cache on our font directory, not the entire font collection
+ (bug #1021757).
+
* Wed Feb 13 2013 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org>
- 5.50-30
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
--- Additional comment from Nicolas Mailhot on 2013-10-22 05:23:13 EDT ---
(In reply to Tim Waugh from comment #1)
> For the postuninstall scriptlet too?
>
> Is there anything planned for the Fedora Project packaging guidelines to
> make sure there are no regressions with this?
Well, what the packaging guidelines actually say is that you shouldn't install
any font without using fontpackages-devel templates and macros or splitting
fonts per family, which means all font packages have the same implementation
and there is no risk of single-package regression.
I appreciate that ghostscript antedates the consolidation work that went into
current font packaging guidelines, but maybe it's time to align it with them?
Also TEX people have spent many years cleaning up and modernizing gs fonts. It
would be worthwhile to package the tex gyre family and use them as replacement,
dropping all legacy font formats and core font calls. I *think* tex gyre
licensing is finally clean and safe (but you'd need to check with spot)
--- Additional comment from Tim Waugh on 2013-10-22 06:15:13 EDT ---
That's a fair point. :-)
That work might have to be done in step with urw-fonts.
--- Additional comment from Fedora Update System on 2013-10-22 06:27:51 EDT ---
ghostscript-fonts-5.50-32.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/ghostscript-fonts-5.50-32.fc19
--- Additional comment from Fedora Update System on 2013-10-22 06:28:34 EDT ---
ghostscript-fonts-5.50-32.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/ghostscript-fonts-5.50-32.fc20
--- Additional comment from Fedora Update System on 2013-10-22 14:51:18 EDT ---
Package ghostscript-fonts-5.50-32.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing
ghostscript-fonts-5.50-32.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-19682/ghostscript-fonts…
then log in and leave karma (feedback).
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1021757
[Bug 1021757] Use fc-cache /usr/share/fonts/<your font directory> instead
of /usr/share/fonts
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=IVu6jiD8ho&a=cc_unsubscribe
https://bugzilla.redhat.com/show_bug.cgi?id=1041294
Bug ID: 1041294
Summary: Bad kerning in
google-crosextra-caladea-fonts-1.002-0.2.20130214.fc19
.noarch
Product: Fedora
Version: 19
Component: google-crosextra-caladea-fonts
Assignee: pnemade(a)redhat.com
Reporter: milan.kerslager(a)pslib.cz
QA Contact: extras-qa(a)fedoraproject.org
CC: fonts-bugs(a)lists.fedoraproject.org,
i18n-bugs(a)lists.fedoraproject.org, pnemade(a)redhat.com
Latest LibreOffice update brings in
google-crosextra-caladea-fonts-1.002-0.2.20130214.fc19.noarch which has bad
kerning, see attachment.
I have bad kerning on some pages (in Chrome), notably on Wikipedia.org.
This package has dependency on libreoffice-core so I have to do:
rpm -e google-crosextra-caladea-fonts --nodeps
After that I restarted Chrome and the page looks like before.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=f0mxWM2ddS&a=cc_unsubscribe
Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=926826
Bug ID: 926826
Summary: xorg-x11-font-utils: Does not support aarch64 in f19
and rawhide
Product: Fedora
Version: rawhide
Component: xorg-x11-font-utils
Severity: unspecified
Priority: unspecified
Assignee: xgl-maint(a)redhat.com
Reporter: dennis(a)ausil.us
QA Contact: extras-qa(a)fedoraproject.org
CC: fonts-bugs(a)lists.fedoraproject.org,
xgl-maint(a)redhat.com
Blocks: 922257 (ARM64)
Support for the ARM 64 bit CPU architecture (aarch64) was introduced in
autoconf 2.69. xorg-x11-font-utils appears to use an earlier version of
autoconf, preventing its being built. This can be fixed in of three ways (In
order of preference):
1. Work with upstream to migrate the package to autoconf 2.69.
2. Rerun autoconf or autoreconf in %prep or %build prior to running
configure.
3. Apply the patch at
http://ausil.fedorapeople.org/aarch64/xorg-x11-font-utils/xorg-x11-font-uti…
which updates config.guess and config.sub to recognize aarch64.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=uzqvnTtkGC&a=cc_unsubscribe
Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=926825
Bug ID: 926825
Summary: xorg-x11-fonts: Does not support aarch64 in f19 and
rawhide
Product: Fedora
Version: rawhide
Component: xorg-x11-fonts
Severity: unspecified
Priority: unspecified
Assignee: xgl-maint(a)redhat.com
Reporter: dennis(a)ausil.us
QA Contact: extras-qa(a)fedoraproject.org
CC: fonts-bugs(a)lists.fedoraproject.org,
xgl-maint(a)redhat.com
Blocks: 922257 (ARM64)
Support for the ARM 64 bit CPU architecture (aarch64) was introduced in
autoconf 2.69. xorg-x11-fonts appears to use an earlier version of
autoconf, preventing its being built. This can be fixed in of three ways (In
order of preference):
1. Work with upstream to migrate the package to autoconf 2.69.
2. Rerun autoconf or autoreconf in %prep or %build prior to running
configure.
3. Apply the patch at
http://ausil.fedorapeople.org/aarch64/xorg-x11-fonts/xorg-x11-fonts-aarch64…
which updates config.guess and config.sub to recognize aarch64.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=sS1OiU7hiw&a=cc_unsubscribe
https://bugzilla.redhat.com/show_bug.cgi?id=1051083
Bug ID: 1051083
Summary: Huge text rendered incorrectly
Product: Fedora
Version: 20
Component: pango
Severity: low
Priority: low
Assignee: tagoh(a)redhat.com
Reporter: amahdal(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: fonts-bugs(a)lists.fedoraproject.org,
i18n-bugs(a)lists.fedoraproject.org, tagoh(a)redhat.com
Created attachment 847731
--> https://bugzilla.redhat.com/attachment.cgi?id=847731&action=edit
incorrect rendering (500K, all visible characters affected)
Description of problem:
When I open this (quite strange, I admit) file:
* ASCII plain text
* only dollar signs (no whitespace whatsoever, reproduces with other chars as
well)
* large number of them (over 320K in my case)
in Mousepad, which uses pango, rendering issues appear. Specifically,
characters appear doubled, with these "ghosts" being few pixels offset.
I have tested this on Fedora 20 with Mousepad and Leafpad, both being
simplistic GUI plain text editors and both using Pango. Hence I'm reporting
this to Pango.
Version-Release number of selected component (if applicable):
pango-1.36.1-1.fc20.x86_64
mousepad-0.3.0-3.fc20.x86_64
leafpad-0.8.18.1-10.fc20.x86_64
How reproducible:
always - with specifically prepared (abnormal) file
Steps to Reproduce:
1. Let N be a large number, 500 thousand or so (see below)
2. Create a plain text file comprised of N identical non-whitespace characters
3. Open the file in Mousepad or Leafpad
Actual results:
Characters are rendered incorrectly, some/all glyphs have a "ghost" with small
offset
Expected results:
Characters should be displayed normally.
Additional info:
Exploring the exact border (N) where the problem appears:
* with 322,639 characters, the text still looks OK
* with 322,640 characters, first character has this "ghost"
* with 322,641 characters, first *two* characters have this "ghost"
* ...etc.
I have also quick-tested this with other characters like "a", and the same
problem appears. I haven't tested with mixed files or with whitespace, though.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=brhs6Z16t4&a=cc_unsubscribe
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.
Summary: Conjunct 'sple' (as in display) is not rendered correctly with Meera font
https://bugzilla.redhat.com/show_bug.cgi?id=543906
Summary: Conjunct 'sple' (as in display) is not rendered
correctly with Meera font
Product: Fedora
Version: 12
Platform: All
OS/Version: Linux
Status: NEW
Severity: medium
Priority: low
Component: smc-fonts
AssignedTo: psatpute(a)redhat.com
ReportedBy: parimbra(a)redhat.com
QAContact: extras-qa(a)fedoraproject.org
CC: fedora-fonts-bugs-list(a)redhat.com,
psatpute(a)redhat.com, rajeeshknambiar(a)gmail.com,
fedora-i18n-bugs(a)redhat.com
Classification: Fedora
Description of problem:
Meera font shipped with Fedora does not display the conjunct 'sple' correctly.
It is working correctly with other fonts and same font in debian.
Version-Release number of selected component (if applicable):
How reproducible:
always
Steps to Reproduce:
1. open gedit
2. select Meera font
3. type ഡിസ്പ്ലെ (സ്പ്ലെ = unicode raw 0d38, 0d4d, 0d2a, 0d4d, 0d32)
Actual results:
സ്പ and ലെ displayed separately
Expected results:
സ് and പ്ലെ rendered separately
Additional info:
https://savannah.nongnu.org/bugs/index.php?28043
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1040288
Bug ID: 1040288
Summary: [or_IN][samyak-fonts] - Change language name from
"Oriya" to "Odia"
Product: Fedora
Version: rawhide
Component: samyak-fonts
Keywords: i18n
Severity: low
Priority: medium
Assignee: psatpute(a)redhat.com
Reporter: smaitra(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: fonts-bugs(a)lists.fedoraproject.org,
i18n-bugs(a)lists.fedoraproject.org, nav007(a)gmail.com,
psatpute(a)redhat.com
Description of problem:
Upstream bug reference : https://sourceware.org/bugzilla/show_bug.cgi?id=15601
Preface : As per the Govt of India record, the State name of Orissa has been
replaced with Odisha (hopefully I am correct with its spelling) and the
language of Odisha State which was Oriya earlier, has been replaced with Odia.
Please change the word "Oriya" occurrences to "Odia" in SPEC file.
Please try to convince upstream as well, to change the font name from
"samyak-oriya" to "samyak-odia" and rename the package name from
"samyak-oriya-fonts" to "samyak-odia-fonts"
Version-Release number of selected component (if applicable):
samyak-oriya-fonts-1.2.2-11.fc20
How reproducible:N/A
Steps to Reproduce:N/A
1.
2.
3.
Actual results:
Please see the description
Expected results:
Please see the description
Additional info:
References:
http://orissamatters.com/2011/11/07/orissa-became-odisha/http://www.ndtv.com/article/india/parliament-passes-bill-to-change-orissa-s…http://orissa.gov.in/e-magazine/Orissareview/2011/Nov/engpdf/9-17.pdf
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=FSl0T9TKJ8&a=cc_unsubscribe