Please do not reply directly to this email. All additional comments should be made in the comments box of this bug.
Summary: CVE-2006-1861 CVE-2007-2754 Multiple freetype1 vulnerabilities [Fedora rawhide]
https://bugzilla.redhat.com/show_bug.cgi?id=502565
Summary: CVE-2006-1861 CVE-2007-2754 Multiple freetype1 vulnerabilities [Fedora rawhide] Product: Fedora Version: rawhide Platform: All URL: http://fedoraproject.org/wiki/Security/TrackingBugs OS/Version: Linux Status: NEW Keywords: Security Severity: medium Priority: medium Component: freetype1 AssignedTo: ajax@redhat.com ReportedBy: thoger@redhat.com QAContact: extras-qa@fedoraproject.org CC: ajax@redhat.com, fedora-fonts-bugs-list@redhat.com Classification: Fedora Target Release: ---
This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in all affected branches.
You should *not* refer to this bug publicly, as it is a private "Fedora Project Contributors" bug.
For comments that are specific to the vulnerability please use bugs filed against "Security Response" product referenced in "Blocks" field.
bug #484437: CVE-2006-1861 freetype: multiple integer overflow vulnerabilities bug #240200: CVE-2007-2754 freetype integer overflow
Please close this bug with RAWHIDE (referencing appropriate N-V-R in Fixed In field if possible) once is it fixed in devel branch. Do *not* include the bug id of this bug in the RPM changelog and the commit message.
For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=502565
Tomas Hoger thoger@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |484437(CVE-2006-1861), | |240200(CVE-2007-2754)
--- Comment #1 from Tomas Hoger thoger@redhat.com 2009-05-26 04:09:30 EDT --- These old issues were previously fixed in FT2, but parts apply to FT1 as well. The fixes were included in RHEL freetype packages update (which contain both FT1 and FT2 on RHEL-2.1 - RHEL-4):
http://rhn.redhat.com/errata/RHSA-2009-0329.html
All current Fedora branches should contain same FT1 version with identical patches, so this should apply to all.
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=502565
--- Comment #2 from Tomas Hoger thoger@redhat.com 2009-05-26 04:15:45 EDT --- Created an attachment (id=345396) --> (https://bugzilla.redhat.com/attachment.cgi?id=345396) FT1 CVE-2006-1861 patch as used in RHSA
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=502565
--- Comment #3 from Tomas Hoger thoger@redhat.com 2009-05-26 04:16:20 EDT --- Created an attachment (id=345397) --> (https://bugzilla.redhat.com/attachment.cgi?id=345397) FT1 CVE-2007-2754 patch as used in RHSA
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=502565
--- Comment #4 from Fedora Update System updates@fedoraproject.org 2009-05-26 16:55:07 EDT --- freetype1-1.4-0.8.pre.fc10 has been submitted as an update for Fedora 10. http://admin.fedoraproject.org/updates/freetype1-1.4-0.8.pre.fc10
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=502565
--- Comment #5 from Fedora Update System updates@fedoraproject.org 2009-05-26 16:55:53 EDT --- freetype1-1.4-0.8.pre.fc11 has been submitted as an update for Fedora 11. http://admin.fedoraproject.org/updates/freetype1-1.4-0.8.pre.fc11
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=502565
Alexei Podtelezhnikov apodtele@ucsd.edu changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |apodtele@ucsd.edu
--- Comment #6 from Alexei Podtelezhnikov apodtele@ucsd.edu 2009-05-26 17:26:18 EDT --- Would you please fix a typo ("obsolote") in the package description and make it more obvious that it is an old-old library by moving the second paragraph upfront?
I am curious which package still uses it and why we cannot drop this old library. Nobody should use it any longer.
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=502565
--- Comment #7 from Tomas Hoger thoger@redhat.com 2009-05-27 02:44:03 EDT --- (In reply to comment #6)
I am curious which package still uses it and why we cannot drop this old library.
$ repoquery -q --whatrequires 'libttf.so.2()(64bit)' freetype1-0:1.4-0.6.pre.fc10.x86_64 freetype1-utils-0:1.4-0.6.pre.fc10.x86_64 MagicPoint-0:1.11b-7.fc10.x86_64 freetype1-devel-0:1.4-0.6.pre.fc10.x86_64
Looks like only MagicPoint now.
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=502565
--- Comment #8 from Tomas Hoger thoger@redhat.com 2009-05-27 02:46:47 EDT --- Ah, looks like Ajax already did few steps to get rid of that last dependency either:
http://cvs.fedoraproject.org/viewvc/rpms/MagicPoint/devel/MagicPoint.spec#re...
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=502565
--- Comment #9 from Adam Jackson ajax@redhat.com 2009-05-27 13:24:24 EDT --- freetype1 is a dead package in F12. We could remove it in F11 without too much hassle but I didn't think it was worth it given how close to release we are.
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=502565
--- Comment #10 from Fedora Update System updates@fedoraproject.org 2009-05-28 04:00:59 EDT --- freetype1-1.4-0.8.pre.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=502565
Fedora Update System updates@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Fixed In Version| |1.4-0.8.pre.fc10 Resolution| |NEXTRELEASE
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=502565
--- Comment #11 from Fedora Update System updates@fedoraproject.org 2009-05-28 04:17:02 EDT --- freetype1-1.4-0.8.pre.fc11 has been pushed to the Fedora 11 stable repository. If problems still persist, please make note of it in this bug report.
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=502565
Fedora Update System updates@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version|1.4-0.8.pre.fc10 |1.4-0.8.pre.fc11
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=502565
--- Comment #12 from Fedora Update System updates@fedoraproject.org 2010-01-05 07:42:46 EDT --- gnome-keyring-2.26.3-2.fc11 has been submitted as an update for Fedora 11. http://admin.fedoraproject.org/updates/gnome-keyring-2.26.3-2.fc11
fonts-bugs@lists.fedoraproject.org