Detalji
Kreirano: 19 Travanj 2012
Ispravljeni su višestruki nedostaci programskog paketa FreeType. Spomenute nedostatke udaljeni napadač može iskoristiti za izvođenje DoS napada i pokretanje proizvoljnog programskog koda.
Paket:
FreeType 2.x
Operacijski sustavi:
SUSE Linux Enterprise Server (SLES) 9
Kritičnost:
5.9
Problem:
neodgovarajuće rukovanje datotekama, pogreška u programskoj funkciji
Iskorištavanje:
udaljeno
Posljedica:
proizvoljno izvršavanje programskog koda, uskraćivanje usluga (DoS)
Rješenje:
programska zakrpa proizvođača
CVE:
CVE-2012-1126, CVE-2012-1127, CVE-2012-1129, CVE-2012-1130, CVE-2012-1131, CVE-2012-1132, CVE-2012-1133, CVE-2012-1134, CVE-2012-1135, CVE-2012-1136, CVE-2012-1138, CVE-2012-1139, CVE-2012-1141, CVE-2012-1142, CVE-2012-1143
Izvorni ID preporuke:
SUSE-SU-2012:0521-1
Izvor:
SUSE
Problem:
Nedostaci su uzrokovani nepravilnostima u datotekama "src/type1/t1parse.c", "src/bdf/bdflib.c", "src/winfonts/winfnt.c", "src/truetype/ttgload.c", "src/bdf/bdflib.c" te prepisivanjem cjelobrojne varijable u funkciji "_bdf_parse_glyphs()".
Posljedica:
Udaljeni napadač je mogao iskoristiti navedene nedostatke za izvođenje napada uskraćivanja usluga i pokretanje zlonamjernog koda.
Rješenje:
Kao rješenje problema, svim korisnicima se savjetuje ugradnja izdane zakrpe.
Izvorni tekst preporuke
SUSE Security Update: Security update for freetype2
______________________________________________________________________________
Announcement ID: SUSE-SU-2012:0521-1
Rating: important
References: #750937 #750938 #750939 #750940 #750941 #750945
#750946 #750947 #750948 #750949 #750950 #750951
#750952 #750953 #750955
Cross-References: CVE-2012-1126 CVE-2012-1127 CVE-2012-1129
CVE-2012-1130 CVE-2012-1131 CVE-2012-1132
CVE-2012-1133 CVE-2012-1134 CVE-2012-1135
CVE-2012-1136 CVE-2012-1138 CVE-2012-1139
CVE-2012-1141 CVE-2012-1142 CVE-2012-1143
Affected Products:
SUSE CORE 9
______________________________________________________________________________
An update that fixes 15 vulnerabilities is now available.
Description:
Specially crafted font files could have caused buffer
overflows in freetype. This has been fixed.
Security Issue references:
* CVE-2012-1142
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1142
>
* CVE-2012-1126
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1126
>
* CVE-2012-1130
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1130
>
* CVE-2012-1129
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1129
>
* CVE-2012-1127
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1127
>
* CVE-2012-1138
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1138
>
* CVE-2012-1136
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1136
>
* CVE-2012-1131
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1131
>
* CVE-2012-1143
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1143
>
* CVE-2012-1141
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1141
>
* CVE-2012-1132
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1132
>
* CVE-2012-1133
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1133
>
* CVE-2012-1135
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1135
>
* CVE-2012-1139
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1139
>
* CVE-2012-1134
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1134
>
Package List:
- SUSE CORE 9 (i586 s390 s390x x86_64):
freetype2-2.1.7-53.27
freetype2-devel-2.1.7-53.27
ft2demos-2.1.7-88.18
- SUSE CORE 9 (x86_64):
freetype2-32bit-9-201203291610
freetype2-devel-32bit-9-201203291610
- SUSE CORE 9 (s390x):
freetype2-32bit-9-201203291618
freetype2-devel-32bit-9-201203291618
References:
http://support.novell.com/security/cve/CVE-2012-1126.html
http://support.novell.com/security/cve/CVE-2012-1127.html
http://support.novell.com/security/cve/CVE-2012-1129.html
http://support.novell.com/security/cve/CVE-2012-1130.html
http://support.novell.com/security/cve/CVE-2012-1131.html
http://support.novell.com/security/cve/CVE-2012-1132.html
http://support.novell.com/security/cve/CVE-2012-1133.html
http://support.novell.com/security/cve/CVE-2012-1134.html
http://support.novell.com/security/cve/CVE-2012-1135.html
http://support.novell.com/security/cve/CVE-2012-1136.html
http://support.novell.com/security/cve/CVE-2012-1138.html
http://support.novell.com/security/cve/CVE-2012-1139.html
http://support.novell.com/security/cve/CVE-2012-1141.html
http://support.novell.com/security/cve/CVE-2012-1142.html
http://support.novell.com/security/cve/CVE-2012-1143.html
https://bugzilla.novell.com/750937
https://bugzilla.novell.com/750938
https://bugzilla.novell.com/750939
https://bugzilla.novell.com/750940
https://bugzilla.novell.com/750941
https://bugzilla.novell.com/750945
https://bugzilla.novell.com/750946
https://bugzilla.novell.com/750947
https://bugzilla.novell.com/750948
https://bugzilla.novell.com/750949
https://bugzilla.novell.com/750950
https://bugzilla.novell.com/750951
https://bugzilla.novell.com/750952
https://bugzilla.novell.com/750953
https://bugzilla.novell.com/750955
http://download.novell.com/patch/finder/?keywords=07580f2d53f7e842f140886bbd54220b
--
To unsubscribe, e-mail: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
For additional commands, e-mail: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
Posljednje sigurnosne preporuke