Ubuntu 11.10: USN-1403-1 Critical FreeType Remote Code Execution

ubuntu

March 23, 2012

FreeType could be made to crash or run programs as your login if it opened aspecially crafted font file.

Summary

FreeType could be made to crash or run programs as your login if it opened a

specially crafted font file.

Software Description:

- freetype: FreeType 2 is a font engine library

Details:

Mateusz Jurczyk discovered that FreeType did not correctly handle certain

malformed BDF font files. If a user were tricked into using a specially crafted

font file, a remote attacker could cause FreeType to crash. (CVE-2012-1126)

Mateusz Jurczyk discovered that FreeType did not correctly handle certain

malformed BDF font files. If a user were tricked into using a specially crafted

font file, a remote attacker could cause FreeType to crash. (CVE-2012-1127)

Mateusz Jurczyk discovered that FreeType did not correctly handle certain

malformed TrueType font files. If a user were tricked into using a specially

crafted font file, a remote attacker could cause FreeType to crash.

(CVE-2012-1128)

Mateusz Jurczyk discovered that FreeType did not correctly handle certain

malformed Type42 font files. If a us...

Read the Full Advisory

Topics Covered

security advisory remote code execution Ubuntu freetype program crash

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  libfreetype6                    2.4.4-2ubuntu1.2

Ubuntu 11.04:
  libfreetype6                    2.4.4-1ubuntu2.3

Ubuntu 10.10:
  libfreetype6                    2.4.2-2ubuntu0.4

Ubuntu 10.04 LTS:
  libfreetype6                    2.3.11-1ubuntu2.6

Ubuntu 8.04 LTS:
  libfreetype6                    2.3.5-1ubuntu4.8.04.9

After a standard system update you need to restart your session to make
all the necessary changes.