Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.
Summary: [RFE] Allow wildcards/regexps in rpm deps
https://bugzilla.redhat.com/show_bug.cgi?id=507292
Summary: [RFE] Allow wildcards/regexps in rpm deps
Product: Fedora
Version: rawhide
Platform: All
OS/Version: Linux
Status: NEW
Severity: medium
Priority: low
Component: rpm
AssignedTo: pmatilai(a)redhat.com
ReportedBy: nicolas.mailhot(a)laposte.net
QAContact: extras-qa(a)fedoraproject.org
CC: pmatilai(a)redhat.com, jnovy(a)redhat.com,
ffesti(a)redhat.com, fedora-fonts-bugs-list(a)redhat.com
Classification: Fedora
(this is mostly a yum-level RFE, but it would be nice if we kept the same
depsolving logic in both apps)
The problem:
Selecting a font is a multi-criterium operation. We need to match on font
family, font style, language support, unicode support, etc. At any time all of
just some of those selection criterii can be provided by the user or
applications.
To have features like font auto-installation work reliably, this matching needs
to extend to the package database
Right now rpm is only allowing to specify atomic provides, so we can have a
font package that
Provides font(dejavusans)
and
Provides
font(:lang=el)
but there is no warranty both those provides are belonging to the same font.
There is no way to distinguish between a package that includes an actual greek
dejavusans and a package that includes a dejavusans greek-less file and another
totally different greek font
To workaround this rpm limitation we've been asking packagers to put font files
belonging to different font families in different packages. However:
1. many still don't
2. it's not technically possible for all font formats, for example the ttc font
format allows mixing of fonts with different characteristics in a single file
The ideal solution:
Ability to have Provides like:
font(comma-separated font name list|comma-separated style list|comma-separated
lang list) (rough mockup that probably needs refining)
And have deps like (dejavu|*|el) work in rpm
(yes a font can declare many different names, be available in many different
styles, cover many different languages)
For ttc files we'd then generate one Provides for each font included in the ttc
bundle
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.
Summary: CVE-2006-3467 CVE-2006-3467 freetype: integer overflow vulnerability due to incomplete fix for CVE-2006-1861
Alias: CVE-2006-3467
https://bugzilla.redhat.com/show_bug.cgi?id=487070
Summary: CVE-2006-3467 CVE-2006-3467 freetype: integer overflow
vulnerability due to incomplete fix for CVE-2006-1861
Product: Security Response
Version: unspecified
Platform: All
URL: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-20
06-3467
OS/Version: Linux
Status: NEW
Status Whiteboard: impact=moderate,source=rehdat,reported=20060710,public
=20060718
Keywords: Security
Severity: medium
Priority: medium
Component: vulnerability
AssignedTo: security-response-team(a)redhat.com
ReportedBy: vdanen(a)redhat.com
CC: ajax(a)redhat.com, fedora-fonts-bugs-list(a)redhat.com
Classification: Other
Target Release: ---
Common Vulnerabilities and Exposures assigned an identifier CVE-2006-3467 to
the following vulnerability:
Name: CVE-2006-3467
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3467
Assigned: 20060710
Reference: URL:
http://www.securityfocus.com/archive/1/archive/1/451426/100/200/threaded
Reference: MISC: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=190593
Integer overflow in FreeType before 2.2 allows remote attackers to cause a
denial of service (crash) and possibly execute arbitrary code via a crafted PCF
file, as demonstrated by the Red Hat
bad1.pcf test file, due to a partial fix of CVE-2006-1861.
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1195021
Bug ID: 1195021
Summary: The ttf oldstandard-sfd fonts are corrupted
Product: Fedora
Version: 20
Component: oldstandard-sfd-fonts
Assignee: sanjay.ankur(a)gmail.com
Reporter: eko(a)lanet.lv
QA Contact: extras-qa(a)fedoraproject.org
CC: fonts-bugs(a)lists.fedoraproject.org,
sanjay.ankur(a)gmail.com
Created attachment 994206
--> https://bugzilla.redhat.com/attachment.cgi?id=994206&action=edit
An exmple of errors in the ttf file.
Description of problem:
The ttf files are with errors.
Version-Release number of selected component (if applicable):
oldstandard-sfd-fonts-2.0.2-13.fc20
The same with oldstandard-sfd-fonts-2.0.2-15.fc21. The corrupted fonts has a
very long history – the ttf files from package
oldstandard-sfd-fonts-2.0.2-3.fc10 are already damaged.
How reproducible:
100%
Steps to Reproduce:
1. Open /usr/share/fonts/oldstandard/* files with any font viewer.
Actual results:
There is a garbage in place of letters (see the attached screen-shot)
Expected results:
Usable fonts.
Additional info:
I try to rebuilt this package from SRPM – no luck. The fontforge refuses to
built usable ttf even by hand. There are two options to solve the issue:
1) To generate OTF not the TTF (preferred solution);
2) To use ready-made ttf from
http://www.fontsquirrel.com/fonts/old-standard-TT.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=0XRZ2KCY22&a=cc_unsubscribe
https://bugzilla.redhat.com/show_bug.cgi?id=1174218
Bug ID: 1174218
Summary: incorrect smoothing
Product: Fedora
Version: 21
Component: freetype
Assignee: mkasik(a)redhat.com
Reporter: lavrinov2004(a)rambler.ru
QA Contact: extras-qa(a)fedoraproject.org
CC: behdad(a)fedoraproject.org,
fonts-bugs(a)lists.fedoraproject.org,
kevin(a)tigcc.ticalc.org, mkasik(a)redhat.com
Description of problem:
In Fedora 21 after an upgrade, upgrade the package to version 2.5.3-13 freetype
resulting stopped working font smoothing in Mozilla Firefox and Wine. In the
previous version 2.5.3-11 freetipe everything worked well.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=qPrspQ2jgn&a=cc_unsubscribe
https://bugzilla.redhat.com/show_bug.cgi?id=1062903
Bug ID: 1062903
Summary: cantarell hints very poorly with new freetype CFF
engine (i.e. regression)
Product: Fedora
Version: 20
Component: abattis-cantarell-fonts
Assignee: ccecchi(a)redhat.com
Reporter: pierre-bugzilla(a)ossman.eu
QA Contact: extras-qa(a)fedoraproject.org
CC: ccecchi(a)redhat.com, fonts-bugs(a)lists.fedoraproject.org
Bug 995643 was filed against freetype for hinting Cantarell very poorly. That
was closed as NOTABUG. But that doesn't change the fact that Cantarell is still
fuzzy, which is a major issue for a UI font. So let's try filing this bug the
other way around. :)
Playing around with ftview suggests that forced auto hinting gives back roughly
the same hinting as in Fedora 19. So could we have that as a fontconfig bandaid
until better hinting information is available in the font itself?
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=y3p7SGp4NL&a=cc_unsubscribe
https://bugzilla.redhat.com/show_bug.cgi?id=1191094
Bug ID: 1191094
Summary: CVE-2014-9671 freetype: Off-by-one error in the
pcf_get_properties function in pcf/pcfread.c
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: vkaigoro(a)redhat.com
CC: behdad(a)fedoraproject.org,
fonts-bugs(a)lists.fedoraproject.org,
kevin(a)tigcc.ticalc.org, mkasik(a)redhat.com
Common Vulnerabilities and Exposures assigned CVE-2014-9671 to the following
issue:
Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in
FreeType
before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer
dereference and application crash) via a crafted PCF file with a 0xffffffff
size
value that is improperly incremented.
http://code.google.com/p/google-security-research/issues/detail?id=157http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0e2f5d51…
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Kh2uxQYUM7&a=cc_unsubscribe
https://bugzilla.redhat.com/show_bug.cgi?id=1191096
Bug ID: 1191096
Summary: CVE-2014-9673 freetype: Integer signedness error in
the Mac_Read_POST_Resource function in base/ftobjs.c
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: vkaigoro(a)redhat.com
CC: behdad(a)fedoraproject.org,
fonts-bugs(a)lists.fedoraproject.org,
kevin(a)tigcc.ticalc.org, mkasik(a)redhat.com
Common Vulnerabilities and Exposures assigned CVE-2014-9673 to the following
issue:
Integer signedness error in the Mac_Read_POST_Resource function in
base/ftobjs.c
in FreeType before 2.5.4 allows remote attackers to cause a denial of service
(heap-based buffer overflow) or possibly have unspecified other impact via a
crafted Mac font.
http://code.google.com/p/google-security-research/issues/detail?id=154http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=35252ae9…
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=cE4QxwCKVN&a=cc_unsubscribe
https://bugzilla.redhat.com/show_bug.cgi?id=1191093
Bug ID: 1191093
Summary: CVE-2014-9670 freetype: Multiple integer signedness
errors in the pcf_get_encodings function
inpcf/pcfread.c
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: vkaigoro(a)redhat.com
CC: behdad(a)fedoraproject.org,
fonts-bugs(a)lists.fedoraproject.org,
kevin(a)tigcc.ticalc.org, mkasik(a)redhat.com
Common Vulnerabilities and Exposures assigned CVE-2014-9670 to the following
issue:
Multiple integer signedness errors in the pcf_get_encodings function in
pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial
of service (integer overflow, NULL pointer dereference, and application crash)
via a crafted PCF file that specifies negative values for the first column and
first row.
http://code.google.com/p/google-security-research/issues/detail?id=158http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=ef1eba75…
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=HvmsnCm2yW&a=cc_unsubscribe