Bugzilla – Bug 730124
VUL-0: freetype2: buffer overflows
Last modified: 2012-04-23 12:53:05 UTC
There have been two issues in freetype reported recently, http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3256 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3439 Both will potentially allow the execution of arbitrary code.
Fix for CVE-2011-3256 is available at: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=9c98fbf634a83c6ea286395f0e788956eafd5aeb
Fix for CVE-2011-3439 is available at: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=14a16e3430ce85538ba9116816cf463cf8827708
The SWAMPID for this issue is 44139. This issue was rated as important. Please submit fixed packages until 2011-11-21. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
*** Bug 728044 has been marked as a duplicate of this bug. ***
hello juergen ... this is now 1 week over the hard deadline, please submit ASAP
ibs: created request id 16700 for SUSE_SLE-11-SP1_GA ibs: created request id 16701 for SUSE_SLE-11_Update_Test ibs: created request id 16702 for SUSE_SLE-10-SP4_Update_Test (also fixes bnc#711487) ibs: created request id 16703 for SUSE_SLE-9-SP4_GA
check_if_valid_source_dir delays submissions, if not all existing patches are used. Commented them out. submitted 16737 to supercede 16700 submitted 16738 to supercede 16701 submitted 16739 to supercede 16702 submitted 16740 to supercede 16703 (this time I was asked to actually supersede)
Update released for: freetype2, freetype2-32bit, freetype2-64bit, freetype2-debuginfo, freetype2-devel, freetype2-devel-32bit, freetype2-devel-64bit, freetype2-x86 Products: SLE-DESKTOP 10-SP4 (i386, x86_64) SLE-SERVER 10-SP4 (i386, ia64, ppc, s390x, x86_64)
Update released for: freetype2, freetype2-32bit, freetype2-debuginfo, freetype2-debuginfo-32bit, freetype2-debuginfo-64bit, freetype2-debuginfo-x86, freetype2-debugsource, freetype2-devel, freetype2-devel-32bit, freetype2-x86 Products: SLE-DEBUGINFO 11-SP1 (i386, ia64, ppc64, s390x, x86_64) SLE-DESKTOP 11-SP1 (i386, x86_64) SLE-SDK 11-SP1 (i386, ia64, ppc64, s390x, x86_64) SLE-SERVER 11-SP1 (i386, ia64, ppc64, s390x, x86_64) SLE-SERVER 11-SP1-TERADATA (x86_64) SLES4VMWARE 11-SP1 (i386, x86_64)
This is an autogenerated message for OBS integration: This bug (730124) was mentioned in https://build.opensuse.org/request/show/96030 Evergreen:11.1 / freetype2 https://build.opensuse.org/request/show/96031 Evergreen:11.2 / freetype2
Update released for: freetype2, freetype2-32bit, freetype2-debuginfo, freetype2-devel, freetype2-devel-32bit Products: SLE-SERVER 10-SP3-TERADATA (x86_64)
This is an autogenerated message for OBS integration: This bug (730124) was mentioned in https://build.opensuse.org/request/show/96213 Evergreen:11.1 / freetype2
Update released for: freetype2, freetype2-devel Products: SUSE-CORE 9-SP3-TERADATA (x86_64)
CVE-2011-3439 was already fixed in the freetype2 in openSUSE 12.1 GA.
openSUSE 12.1 also not affected by other CVE (was fixed before shipment)
correction, CVE-2011-3439 was NOT fixed in the freetype2 in openSUSE 12.1 GA. will be in this update.
submitted 11.3, 11.4 and 12.1 based on the evergreen patches.
This is an autogenerated message for OBS integration: This bug (730124) was mentioned in https://build.opensuse.org/request/show/96870 11.3 / freetype2 https://build.opensuse.org/request/show/96871 12.1 / freetype2
This is an autogenerated message for OBS integration: This bug (730124) was mentioned in https://build.opensuse.org/request/show/96997 12.1 / freetype2
released
Update released for: freetype2, freetype2-debugsource, freetype2-devel, libfreetype6, libfreetype6-debuginfo Products: openSUSE 11.3 (debug, i586, x86_64) openSUSE 11.4 (debug, i586, x86_64)
Update released for: freetype2, freetype2-32bit, freetype2-debuginfo, freetype2-devel, freetype2-devel-32bit, ft2demos, ft2demos-debuginfo Products: SLE-SERVER 10-SP2-LTSS (i386, s390x, x86_64)