what you don't know can hurt you

Mandriva Linux Security Advisory 2010-235

Mandriva Linux Security Advisory 2010-235
Posted Nov 16, 2010
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2010-235 - An error exists in the "ft_var_readpackedpoints()" function in src/truetype/ttgxvar.c when processing TrueType GX fonts and can be exploited to cause a heap-based buffer overflow via a specially crafted font. The updated packages have been patched to correct these issues.

tags | advisory, overflow
systems | linux, mandriva
advisories | CVE-2010-3855
MD5 | 687cc129c7f597fde82f66214ccdacbd

Mandriva Linux Security Advisory 2010-235

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2010:235
http://www.mandriva.com/security/
_______________________________________________________________________

Package : freetype2
Date : November 16, 2010
Affected: Corporate 4.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities were discovered and corrected in freetype2:

An error exists in the "ft_var_readpackedpoints()" function in
src/truetype/ttgxvar.c when processing TrueType GX fonts and can
be exploited to cause a heap-based buffer overflow via a specially
crafted font (CVE-2010-3855).

The updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3855
http://secunia.com/advisories/41738
_______________________________________________________________________

Updated Packages:

Corporate 4.0:
8fda305a5fae4aefca37ba2830b1a345 corporate/4.0/i586/libfreetype6-2.1.10-9.14.20060mlcs4.i586.rpm
2b33f336eaa4105112adbac8780c7be1 corporate/4.0/i586/libfreetype6-devel-2.1.10-9.14.20060mlcs4.i586.rpm
129a3208e9f5c6a1c10660930736bb5c corporate/4.0/i586/libfreetype6-static-devel-2.1.10-9.14.20060mlcs4.i586.rpm
08ee97b65dff2197555a55ffb8aabcde corporate/4.0/SRPMS/freetype2-2.1.10-9.14.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
c19152256818aff210dde26c75e588d7 corporate/4.0/x86_64/lib64freetype6-2.1.10-9.14.20060mlcs4.x86_64.rpm
ee453b7d6affc8830283e5f2366edf72 corporate/4.0/x86_64/lib64freetype6-devel-2.1.10-9.14.20060mlcs4.x86_64.rpm
7ea2ccaeeccf5250f053eec9c74b1d9a corporate/4.0/x86_64/lib64freetype6-static-devel-2.1.10-9.14.20060mlcs4.x86_64.rpm
08ee97b65dff2197555a55ffb8aabcde corporate/4.0/SRPMS/freetype2-2.1.10-9.14.20060mlcs4.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFM4kTAmqjQ0CJFipgRAm7qAJ9ZrJZFcEolbskRtdhmAVeoo3dkwwCeOCTA
yPEXVemOYVrUmY1OpYUoJ8o=
=N3n6
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

July 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    15 Files
  • 2
    Jul 2nd
    19 Files
  • 3
    Jul 3rd
    12 Files
  • 4
    Jul 4th
    1 Files
  • 5
    Jul 5th
    2 Files
  • 6
    Jul 6th
    25 Files
  • 7
    Jul 7th
    35 Files
  • 8
    Jul 8th
    4 Files
  • 9
    Jul 9th
    9 Files
  • 10
    Jul 10th
    7 Files
  • 11
    Jul 11th
    4 Files
  • 12
    Jul 12th
    4 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close