[Bug 450774] CVE-2008-1808 FreeType off-by-one flaws
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: CVE-2008-1808 FreeType off-by-one flaws
Alias: CVE-2008-1808
https://bugzilla.redhat.com/show_bug.cgi?id=450774
Bug 450774 depends on bug 451213, which changed state.
Bug 451213 Summary: CVE-2008-1806 CVE-2008-1807 CVE-2008-1808 Multiple freetype vulnerabilities [Fedora 9]
https://bugzilla.redhat.com/show_bug.cgi?id=451213
What |Old Value |New Value
----------------------------------------------------------------------------
Status|MODIFIED |CLOSED
Resolution| |CURRENTRELEASE
------- Additional Comments From updates(a)fedoraproject.org 2008-06-17 23:15 EST -------
freetype-2.3.5-4.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
16 years
[Bug 451213] New: CVE-2008-1806 CVE-2008-1807 CVE-2008-1808 Multiple freetype vulnerabilities [Fedora 9]
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=451213
Summary: CVE-2008-1806 CVE-2008-1807 CVE-2008-1808 Multiple
freetype vulnerabilities [Fedora 9]
Product: Fedora
Version: 9
Platform: All
URL: http://fedoraproject.org/wiki/Security/TrackingBugs
OS/Version: Linux
Status: NEW
Severity: low
Priority: low
Component: freetype
AssignedTo: besfahbo(a)redhat.com
ReportedBy: thoger(a)redhat.com
QAContact: extras-qa(a)fedoraproject.org
CC: fedora-fonts-bugs-list(a)redhat.com
This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in all affected branches.
You should *not* refer to this bug publicly, as it is a private "Fedora Project Contributors" bug.
For comments that are specific to the vulnerability please use bugs filed against "Security Response" product referenced in "Blocks" field.
bug #450768: CVE-2008-1806 FreeType PFB integer overflow
bug #450773: CVE-2008-1807 FreeType invalid free() flaw
bug #450774: CVE-2008-1808 FreeType off-by-one flaws
When creating an update for the version this this bug is reported against please include the bug IDs of respective bugs filed against "Security Response" product as well as of this bug and let the update system close them. Please note that the update announcement will (and should) contain only references to "Security Response" bugs as long as the tracking bug is restricted to "Fedora Project Contributors".
For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
16 years
[Bug 16792] [GTK] Fails to render Japanese/Chinese text with simple path
by bugzilla-daemon@webkit.org
https://bugs.webkit.org/show_bug.cgi?id=16792
------- Comment #5 from joshchia(a)gmail.com 2008-06-17 17:15 PDT -------
I'm not familiar with the font-related code, but my initial impression of
FontFallbackList based on its name and interface suggests that it's a list of
FontDatas from which you can pick one that has the glyphs for the string you
want to display, by calling FontFallbackList::fontDataForCharacters().
However, it seems that the only time anything is added to the list is when
Font::Font() calls FontFallbackList::setPlatformFont(). If FontFallbackList is
really a fallback list, then, shouldn't more fonts be added to it at other
places?
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
16 years
[Bug 450774] CVE-2008-1808 FreeType off-by-one flaws
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: CVE-2008-1808 FreeType off-by-one flaws
Alias: CVE-2008-1808
https://bugzilla.redhat.com/show_bug.cgi?id=450774
------- Additional Comments From kevin(a)tigcc.ticalc.org 2008-06-17 12:47 EST -------
On the other hand, freetype-freeworld in a popular third-party repository is
also affected by the BCI issue, in addition to the issues also affecting the
Fedora freetype package. A fixed freetype-freeworld will be built in that
repository as soon as possible.
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
16 years
[Bug 450774] CVE-2008-1808 FreeType off-by-one flaws
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: CVE-2008-1808 FreeType off-by-one flaws
Alias: CVE-2008-1808
https://bugzilla.redhat.com/show_bug.cgi?id=450774
------- Additional Comments From thoger(a)redhat.com 2008-06-17 06:01 EST -------
The TTF issue affects TTF virtual machine byte code interpreter (BCI). This
interpreter is disabled by default on freetype 2.x (libtruetype) due to a patent
issues as described on the upstream web page:
http://www.freetype.org/patents.html
All Red Hat Enterprise Linux and Fedora freetype 2.x versions have BCI disabled
and are not affected by the TTF part of CVE-2008-1808. Only custom rebuilds
with BCI enabled may possibly be affected.
Freetype 1.x (libttf) does enable BCI by default, but is explicitly disabled in
freetype packages on Red Hat Enterprise Linux 3 and 4 and in freetype1 packages
in all Fedora versions (via freetype-1.4-disable-ft1-bci.patch).
Red Hat Enterprise Linux 5 does not ship freetype 1.x library. Freetype 1.x on
Red Hat Enterprise Linux 2.1 is built with BCI enabled.
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
16 years