Fedora Security Advisory 2017-71b9a2ef5f Critical: freetype Heap Overflow

The FreeType engine is a free and portable font rendering

engine, developed to provide advanced font support for a variety of

platforms and environments. FreeType is a library which can open and

manages font files as well as efficiently load, hint and render

individual glyphs. FreeType is not a font server or a complete

text-rendering library.

Security fixes for CVE-2017-8105 and CVE-2017-8287.

[ 1 ] Bug #1446073 - CVE-2017-8287 freetype: heap-based buffer overflow related to the t1_builder_close_contour function

https://bugzilla.redhat.com/show_bug.cgi?id=1446073

[ 2 ] Bug #1446500 - CVE-2017-8105 freetype: heap-based buffer overflow related to the t1_decoder_parse_charstrings

https://bugzilla.redhat.com/show_bug.cgi?id=1446500

su -c 'dnf upgrade freetype' at the command line.

For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

https://fedoraproject.org/security/

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org