touch-packages team mailing list archive

[Launchpad Bug Tracker <1492124@xxxxxxxxxxxxxxxxxx>]

This bug was fixed in the package freetype - 2.5.2-1ubuntu2.5

---------------
freetype (2.5.2-1ubuntu2.5) trusty-security; urgency=medium

  * SECURITY UPDATE: uninitialized memory reads (LP: #1449225)
    - debian/patches-freetype/savannah-bug-41309.patch: fix use of
      uninitialized data in src/cid/cidload.c, src/psaux/psobjs.c,
      src/type1/t1load.c, src/type42/t42parse.c.
    - No CVE number
  * SECURITY UPDATE: denial of service via infinite loop in parse_encode
    (LP: #1492124)
    - debian/patches-freetype/savannah-bug-41590.patch: protect against
      invalid charcode in src/type1/t1load.c.
    - No CVE number

 -- Marc Deslauriers <marc.deslauriers@xxxxxxxxxx>  Thu, 10 Sep 2015
07:09:04 -0400

** Changed in: freetype (Ubuntu Trusty)
       Status: Confirmed => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to freetype in Ubuntu.
https://bugs.launchpad.net/bugs/1492124

Title:
  infinite loop in parse_encoding (t1load.c)

Status in FreeType:
  Unknown
Status in freetype package in Ubuntu:
  Confirmed
Status in freetype source package in Precise:
  Confirmed
Status in freetype source package in Trusty:
  Fix Released
Status in freetype source package in Vivid:
  Fix Released
Status in freetype source package in Wily:
  Confirmed

Bug description:
  Ubuntu 14.04's libfreetype has not been patched with the fix for [1], thus applications that use libfreetype6 are vulnerable to infinite loops. e.g. Chromium / Google Chrome. [2] If you add a small patch to apply freetype commit 
  df14e6 [3], that should fix the problem. I verified this locally.

  I have not checked other Ubuntu releases to see if they are affected.

  [1] http://savannah.nongnu.org/bugs/index.php?41590
  [2] https://code.google.com/p/chromium/issues/detail?id=459050
  [3] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=df14e6c0b9592cbb24d5381dfc6106b14f915e75

To manage notifications about this bug go to:
https://bugs.launchpad.net/freetype/+bug/1492124/+subscriptions