Detalji
Kreirano: 12 Travanj 2012
U radu programskog paketa FreeType2 otkriven je niz sigurnosnih nedostataka koje udaljeni napadači mogu iskoristiti za izvođenje DoS napada i pokretanje proizvoljnog programskog koda.
Paket:
FreeType 2.x
Operacijski sustavi:
openSUSE 11.4, openSUSE 12.1
Kritičnost:
5.9
Problem:
neodgovarajuće rukovanje datotekama, pogreška u programskoj funkciji
Iskorištavanje:
udaljeno
Posljedica:
proizvoljno izvršavanje programskog koda, uskraćivanje usluga (DoS)
Rješenje:
programska zakrpa proizvođača
CVE:
CVE-2012-1126, CVE-2012-1127, CVE-2012-1128, CVE-2012-1129, CVE-2012-1130, CVE-2012-1131, CVE-2012-1132, CVE-2012-1133, CVE-2012-1134, CVE-2012-1135, CVE-2012-1136, CVE-2012-1137, CVE-2012-1138, CVE-2012-1139, CVE-2012-1140, CVE-2012-1141, CVE-2012-1142
Izvorni ID preporuke:
openSUSE-SU-2012:0489-1
Izvor:
SUSE
Problem:
Nedostaci su uzrokovani nepravilnostima u datotekama "src/type1/t1parse.c", "src/bdf/bdflib.c", "src/winfonts/winfnt.c", "src/truetype/ttgload.c", "src/bdf/bdflib.c" te prepisivanjem cjelobrojne varijable u funkciji "_bdf_parse_glyphs()".
Posljedica:
Napadaču omogućuju izvođenje DoS napada i pokretanje proizvoljnog programskog koda.
Rješenje:
Korisnici se potiču na korištenje ispravljenih inačica.
Izvorni tekst preporuke
openSUSE Security Update: freetype2 update
______________________________________________________________________________
Announcement ID: openSUSE-SU-2012:0489-1
Rating: important
References:
Cross-References: CVE-2012-1126 CVE-2012-1127 CVE-2012-1128
CVE-2012-1129 CVE-2012-1130 CVE-2012-1131
CVE-2012-1132 CVE-2012-1133 CVE-2012-1134
CVE-2012-1135 CVE-2012-1136 CVE-2012-1137
CVE-2012-1138 CVE-2012-1139 CVE-2012-1140
CVE-2012-1141 CVE-2012-1142 CVE-2012-1143
CVE-2012-1144
Affected Products:
openSUSE 12.1
openSUSE 11.4
______________________________________________________________________________
An update that fixes 19 vulnerabilities is now available.
Description:
Specially crafted font files could cause buffer overflows
in freetype
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 12.1:
zypper in -t patch openSUSE-2012-220
- openSUSE 11.4:
zypper in -t patch openSUSE-2012-220
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 12.1 (i586 x86_64):
freetype2-debugsource-2.4.7-6.1
freetype2-devel-2.4.7-6.1
libfreetype6-2.4.7-6.1
libfreetype6-debuginfo-2.4.7-6.1
- openSUSE 12.1 (x86_64):
freetype2-devel-32bit-2.4.7-6.1
libfreetype6-32bit-2.4.7-6.1
libfreetype6-debuginfo-32bit-2.4.7-6.1
- openSUSE 12.1 (ia64):
libfreetype6-debuginfo-x86-2.4.7-6.1
libfreetype6-x86-2.4.7-6.1
- openSUSE 11.4 (i586 x86_64):
freetype2-debugsource-2.4.4-7.24.1
freetype2-devel-2.4.4-7.24.1
libfreetype6-2.4.4-7.24.1
libfreetype6-debuginfo-2.4.4-7.24.1
- openSUSE 11.4 (x86_64):
freetype2-devel-32bit-2.4.4-7.24.1
libfreetype6-32bit-2.4.4-7.24.1
libfreetype6-debuginfo-32bit-2.4.4-7.24.1
- openSUSE 11.4 (ia64):
libfreetype6-debuginfo-x86-2.4.4-7.24.1
libfreetype6-x86-2.4.4-7.24.1
References:
http://support.novell.com/security/cve/CVE-2012-1126.html
http://support.novell.com/security/cve/CVE-2012-1127.html
http://support.novell.com/security/cve/CVE-2012-1128.html
http://support.novell.com/security/cve/CVE-2012-1129.html
http://support.novell.com/security/cve/CVE-2012-1130.html
http://support.novell.com/security/cve/CVE-2012-1131.html
http://support.novell.com/security/cve/CVE-2012-1132.html
http://support.novell.com/security/cve/CVE-2012-1133.html
http://support.novell.com/security/cve/CVE-2012-1134.html
http://support.novell.com/security/cve/CVE-2012-1135.html
http://support.novell.com/security/cve/CVE-2012-1136.html
http://support.novell.com/security/cve/CVE-2012-1137.html
http://support.novell.com/security/cve/CVE-2012-1138.html
http://support.novell.com/security/cve/CVE-2012-1139.html
http://support.novell.com/security/cve/CVE-2012-1140.html
http://support.novell.com/security/cve/CVE-2012-1141.html
http://support.novell.com/security/cve/CVE-2012-1142.html
http://support.novell.com/security/cve/CVE-2012-1143.html
http://support.novell.com/security/cve/CVE-2012-1144.html
--
To unsubscribe, e-mail: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
For additional commands, e-mail: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
Posljednje sigurnosne preporuke