what you don't know can hurt you

Mandriva Linux Security Advisory 2010-235

Mandriva Linux Security Advisory 2010-235
Posted Nov 16, 2010
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2010-235 - An error exists in the "ft_var_readpackedpoints()" function in src/truetype/ttgxvar.c when processing TrueType GX fonts and can be exploited to cause a heap-based buffer overflow via a specially crafted font. The updated packages have been patched to correct these issues.

tags | advisory, overflow
systems | linux, mandriva
advisories | CVE-2010-3855
SHA-256 | 513e57f39a0528458ed28074ae028710308370fd51826b6bada5e299dfb1ea87

Mandriva Linux Security Advisory 2010-235

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2010:235
http://www.mandriva.com/security/
_______________________________________________________________________

Package : freetype2
Date : November 16, 2010
Affected: Corporate 4.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities were discovered and corrected in freetype2:

An error exists in the "ft_var_readpackedpoints()" function in
src/truetype/ttgxvar.c when processing TrueType GX fonts and can
be exploited to cause a heap-based buffer overflow via a specially
crafted font (CVE-2010-3855).

The updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3855
http://secunia.com/advisories/41738
_______________________________________________________________________

Updated Packages:

Corporate 4.0:
8fda305a5fae4aefca37ba2830b1a345 corporate/4.0/i586/libfreetype6-2.1.10-9.14.20060mlcs4.i586.rpm
2b33f336eaa4105112adbac8780c7be1 corporate/4.0/i586/libfreetype6-devel-2.1.10-9.14.20060mlcs4.i586.rpm
129a3208e9f5c6a1c10660930736bb5c corporate/4.0/i586/libfreetype6-static-devel-2.1.10-9.14.20060mlcs4.i586.rpm
08ee97b65dff2197555a55ffb8aabcde corporate/4.0/SRPMS/freetype2-2.1.10-9.14.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
c19152256818aff210dde26c75e588d7 corporate/4.0/x86_64/lib64freetype6-2.1.10-9.14.20060mlcs4.x86_64.rpm
ee453b7d6affc8830283e5f2366edf72 corporate/4.0/x86_64/lib64freetype6-devel-2.1.10-9.14.20060mlcs4.x86_64.rpm
7ea2ccaeeccf5250f053eec9c74b1d9a corporate/4.0/x86_64/lib64freetype6-static-devel-2.1.10-9.14.20060mlcs4.x86_64.rpm
08ee97b65dff2197555a55ffb8aabcde corporate/4.0/SRPMS/freetype2-2.1.10-9.14.20060mlcs4.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFM4kTAmqjQ0CJFipgRAm7qAJ9ZrJZFcEolbskRtdhmAVeoo3dkwwCeOCTA
yPEXVemOYVrUmY1OpYUoJ8o=
=N3n6
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

May 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    0 Files
  • 2
    May 2nd
    15 Files
  • 3
    May 3rd
    19 Files
  • 4
    May 4th
    24 Files
  • 5
    May 5th
    15 Files
  • 6
    May 6th
    14 Files
  • 7
    May 7th
    0 Files
  • 8
    May 8th
    0 Files
  • 9
    May 9th
    13 Files
  • 10
    May 10th
    7 Files
  • 11
    May 11th
    99 Files
  • 12
    May 12th
    45 Files
  • 13
    May 13th
    7 Files
  • 14
    May 14th
    0 Files
  • 15
    May 15th
    0 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    26 Files
  • 18
    May 18th
    4 Files
  • 19
    May 19th
    17 Files
  • 20
    May 20th
    2 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    6 Files
  • 24
    May 24th
    19 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close