Fedora 25: freetype Security Update

May 7, 2017

Security fixes for CVE-2017-8105 and CVE-2017-8287.

Summary

The FreeType engine is a free and portable font rendering

engine, developed to provide advanced font support for a variety of

platforms and environments. FreeType is a library which can open and

manages font files as well as efficiently load, hint and render

individual glyphs. FreeType is not a font server or a complete

text-rendering library.

Security fixes for CVE-2017-8105 and CVE-2017-8287.

[ 1 ] Bug #1446073 - CVE-2017-8287 freetype: heap-based buffer overflow related to the t1_builder_close_contour function

https://bugzilla.redhat.com/show_bug.cgi?id=1446073

[ 2 ] Bug #1446500 - CVE-2017-8105 freetype: heap-based buffer overflow related to the t1_decoder_parse_charstrings

https://bugzilla.redhat.com/show_bug.cgi?id=1446500

su -c 'dnf upgrade freetype' at the command line.

For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

https://fedoraproject.org/security/

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org

FEDORA-2017-5760b80676 2017-05-06 17:08:31.477853 Product : Fedora 25 Version : 2.6.5 Release : 7.fc25 URL : https://freetype.org/ Summary : A free and portable font rendering engine Description : The FreeType engine is a free and portable font rendering engine, developed to provide advanced font support for a variety of platforms and environments. FreeType is a library which can open and manages font files as well as efficiently load, hint and render individual glyphs. FreeType is not a font server or a complete text-rendering library. Security fixes for CVE-2017-8105 and CVE-2017-8287. [ 1 ] Bug #1446073 - CVE-2017-8287 freetype: heap-based buffer overflow related to the t1_builder_close_contour function https://bugzilla.redhat.com/show_bug.cgi?id=1446073 [ 2 ] Bug #1446500 - CVE-2017-8105 freetype: heap-based buffer overflow related to the t1_decoder_parse_charstrings https://bugzilla.redhat.com/show_bug.cgi?id=1446500 su -c 'dnf upgrade freetype' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ package-announce mailing list -- package-announce@lists.fedoraproject.org To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org