Mateusz Jurczyk discovered multiple vulnerabilities in Freetype. Opening malformed fonts may result in denial of service or the execution of arbitrary code. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-3461-1
FreeType could be made to crash or run programs as your login if it opened a specially crafted font file.. =========================================================================Ubuntu Security Notice USN-2148-1 March 17, 2014 freetype vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 13.10 Summary: FreeType could be made to crash or run programs as your login if it opened a specially crafted font file. Software Description: - freetype: FreeType 2 is a font engine library Details: Mateusz Jurczyk discovered that FreeType did not correctly handle certain malformed font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash or possibly execute arbitrary code with user privileges. (CVE-2014-2240, CVE-2014-2241) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 13.10: libfreetype6 2.4.12-0ubuntu1.1 After a standard system update you need to restart your session to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-2148-1 CVE-2014-2240, CVE-2014-2241 Package Information: https://launchpad.net/ubuntu/+source/freetype/2.4.12-0ubuntu1.1 . The Ubuntu Security Notice USN-2149-1 addresses vulnerabilities in the OpenSSL package that can potentially compromise user data through flawed secure connections.. FreeType Exploit, Ubuntu Update, Font Vulnerability. . Severity: Critical. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.