[Bug 450774] CVE-2008-1808 FreeType off-by-one flaws
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: CVE-2008-1808 FreeType off-by-one flaws
Alias: CVE-2008-1808
https://bugzilla.redhat.com/show_bug.cgi?id=450774
------- Additional Comments From j.w.r.degoede(a)hhs.nl 2008-06-18 04:11 EST -------
(In reply to comment #13)
> In reply to https://bugzilla.redhat.com/show_bug.cgi?id=450773#c12 :
>
> maxTwilightPoints check does not seem directly related and was probably added as
> additional sanity check.
>
> As the .pfb is not supported by freetype1 we should ideally try to avoid
> mentioning CVE-2008-1806 and CVE-2008-1807 in the freetype1 RPM changelog.
>
Its a little too late for that, as a freetype1 with those in the ChangeLog is
already in rawhide. I did add "(where applicable)" to the changelog to indicate
not all of the mentioned issues where relevant for freetype1.
> As for bodhi update request, we do not need to submit updated freetype1 packages
> as security update, as (binary) Fedora packages were not affected by this
> problem.
Ok.
> But I'm ok with pushing it as security update anyway, provided that we
> clearly mention in the notes that only users rebuilding freetype1 with bci were
> affected by the problem. Update request should only refer to this bug, not to
> the bugs for other CVEs.
I don't believe anyone is offering rebuild freetype1 packages with BCI enabled,
so I considered this issue closed then. If you want I can still do an update,
esp. since the new freetype1 is already build in bodhi for F-8 and F-9.
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
16 years
[Bug 450774] CVE-2008-1808 FreeType off-by-one flaws
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: CVE-2008-1808 FreeType off-by-one flaws
Alias: CVE-2008-1808
https://bugzilla.redhat.com/show_bug.cgi?id=450774
Bug 450774 depends on bug 451212, which changed state.
Bug 451212 Summary: CVE-2008-1806 CVE-2008-1807 CVE-2008-1808 Multiple freetype vulnerabilities [Fedora 8]
https://bugzilla.redhat.com/show_bug.cgi?id=451212
What |Old Value |New Value
----------------------------------------------------------------------------
Status|MODIFIED |CLOSED
Resolution| |CURRENTRELEASE
------- Additional Comments From thoger(a)redhat.com 2008-06-18 03:19 EST -------
In reply to https://bugzilla.redhat.com/show_bug.cgi?id=450773#c12 :
The only part of the upstream patch that should be related to .ttf issue covered
by this CVE id is:
- if ( last_point > CUR.zp2.n_points )
+ if ( BOUNDS ( last_point , CUR.zp2.n_points ) )
maxTwilightPoints check does not seem directly related and was probably added as
additional sanity check.
As the .pfb is not supported by freetype1 we should ideally try to avoid
mentioning CVE-2008-1806 and CVE-2008-1807 in the freetype1 RPM changelog.
As for bodhi update request, we do not need to submit updated freetype1 packages
as security update, as (binary) Fedora packages were not affected by this
problem. But I'm ok with pushing it as security update anyway, provided that we
clearly mention in the notes that only users rebuilding freetype1 with bci were
affected by the problem. Update request should only refer to this bug, not to
the bugs for other CVEs.
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
16 years
[Bug 450773] CVE-2008-1807 FreeType invalid free() flaw
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: CVE-2008-1807 FreeType invalid free() flaw
Alias: CVE-2008-1807
https://bugzilla.redhat.com/show_bug.cgi?id=450773
------- Additional Comments From besfahbo(a)redhat.com 2008-06-18 03:13 EST -------
Hans,
The only CVE that applies to FreeType 1 only matters if compiling with patented
byte-code interpreter. Your backported patch fixes that. I already used your
patch (got it from CVS) for RHEL2.1 freetype 1 and RH security team was happy.
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
16 years
[Bug 450773] CVE-2008-1807 FreeType invalid free() flaw
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: CVE-2008-1807 FreeType invalid free() flaw
Alias: CVE-2008-1807
https://bugzilla.redhat.com/show_bug.cgi?id=450773
Bug 450773 depends on bug 451212, which changed state.
Bug 451212 Summary: CVE-2008-1806 CVE-2008-1807 CVE-2008-1808 Multiple freetype vulnerabilities [Fedora 8]
https://bugzilla.redhat.com/show_bug.cgi?id=451212
What |Old Value |New Value
----------------------------------------------------------------------------
Status|MODIFIED |CLOSED
Resolution| |CURRENTRELEASE
------- Additional Comments From j.w.r.degoede(a)hhs.nl 2008-06-18 02:55 EST -------
Hi All,
I see that an update for this for freetype2 has been released, good! I still
need to push the freetype1 builds fixing some of the same issues through bodhi.
But I needs some help to know what (and which CVE's) to put in bodhi.
I know that not all issues apply to freetype1 due to it not having support for
bdf and type1 fonts, still some parts of the patch provided here did apply to
freetype1 (and more then just the BCI fix).
I'll attach the backported patch here, and hope that some of you can shed some
light on this. I cannot find out what to put in the advisory myself, as the
parts of the patch that have been backported do not seem to match any of the CVE
descriptions.
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
16 years
[Bug 450773] CVE-2008-1807 FreeType invalid free() flaw
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: CVE-2008-1807 FreeType invalid free() flaw
Alias: CVE-2008-1807
https://bugzilla.redhat.com/show_bug.cgi?id=450773
Bug 450773 depends on bug 451213, which changed state.
Bug 451213 Summary: CVE-2008-1806 CVE-2008-1807 CVE-2008-1808 Multiple freetype vulnerabilities [Fedora 9]
https://bugzilla.redhat.com/show_bug.cgi?id=451213
What |Old Value |New Value
----------------------------------------------------------------------------
Status|MODIFIED |CLOSED
Resolution| |CURRENTRELEASE
------- Additional Comments From updates(a)fedoraproject.org 2008-06-17 23:15 EST -------
freetype-2.3.5-4.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
16 years
[Bug 451212] New: CVE-2008-1806 CVE-2008-1807 CVE-2008-1808 Multiple freetype vulnerabilities [Fedora 8]
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=451212
Summary: CVE-2008-1806 CVE-2008-1807 CVE-2008-1808 Multiple
freetype vulnerabilities [Fedora 8]
Product: Fedora
Version: 8
Platform: All
URL: http://fedoraproject.org/wiki/Security/TrackingBugs
OS/Version: Linux
Status: NEW
Severity: low
Priority: low
Component: freetype
AssignedTo: besfahbo(a)redhat.com
ReportedBy: thoger(a)redhat.com
QAContact: extras-qa(a)fedoraproject.org
CC: fedora-fonts-bugs-list(a)redhat.com
This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in all affected branches.
You should *not* refer to this bug publicly, as it is a private "Fedora Project Contributors" bug.
For comments that are specific to the vulnerability please use bugs filed against "Security Response" product referenced in "Blocks" field.
bug #450768: CVE-2008-1806 FreeType PFB integer overflow
bug #450773: CVE-2008-1807 FreeType invalid free() flaw
bug #450774: CVE-2008-1808 FreeType off-by-one flaws
When creating an update for the version this this bug is reported against please include the bug IDs of respective bugs filed against "Security Response" product as well as of this bug and let the update system close them. Please note that the update announcement will (and should) contain only references to "Security Response" bugs as long as the tracking bug is restricted to "Fedora Project Contributors".
For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
16 years