Message-ID: <20070530224527.GP14736@outflux.net>
Date: Wed, 30 May 2007 15:45:27 -0700
From: Kees Cook <kees@...ntu.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: [USN-466-1] freetype vulnerability

=========================================================== 
Ubuntu Security Notice USN-466-1               May 30, 2007
freetype vulnerability
CVE-2007-2754
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 6.10
Ubuntu 7.04

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  libfreetype6                             2.1.10-1ubuntu2.4

Ubuntu 6.10:
  libfreetype6                             2.2.1-5ubuntu0.2

Ubuntu 7.04:
  libfreetype6                             2.2.1-5ubuntu1.1

After a standard system upgrade you need to restart your session or
reboot your computer to effect the necessary changes.

Details follow:

Victor Stinner discovered that freetype did not correctly verify the
number of points in a TrueType font.  If a user were tricked into using
a specially crafted font, a remote attacker could execute arbitrary code
with user privileges.


Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.1.10-1ubuntu2.4.diff.gz
      Size/MD5:    59961 56e423eaba2a421a4dc629c001b0c0e9
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.1.10-1ubuntu2.4.dsc
      Size/MD5:      710 78cf6cb2c7bdbb66e3cb1defeb776070
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.1.10.orig.tar.gz
      Size/MD5:  1323617 adf145ce51196ad1b3054d5fb032efe6

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.1.10-1ubuntu2.4_amd64.deb
      Size/MD5:   133862 208fb4911a69f8531372987f67c160ec
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.1.10-1ubuntu2.4_amd64.deb
      Size/MD5:   717436 0c4e3ee7c34df9826e78a7d8b6304575
    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.1.10-1ubuntu2.4_amd64.udeb
      Size/MD5:   251696 b150010bbc91b7ceb0b57e2e957d9f95
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.1.10-1ubuntu2.4_amd64.deb
      Size/MD5:   439866 9b1000f03c7402102b55359cf8d7bba1

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.1.10-1ubuntu2.4_i386.deb
      Size/MD5:   117358 2860f31f56af3bc7eb31b7d51667f0ac
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.1.10-1ubuntu2.4_i386.deb
      Size/MD5:   677462 51565ff05b8ec83f9ff1ba87420ebb8f
    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.1.10-1ubuntu2.4_i386.udeb
      Size/MD5:   227276 675ea7a2a54d35647f9e7287c1a53ee7
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.1.10-1ubuntu2.4_i386.deb
      Size/MD5:   415436 73043a17a766bedfd6a90fb8f1415020

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.1.10-1ubuntu2.4_powerpc.deb
      Size/MD5:   134244 73174f9b2b4defd227890c9b41d8baef
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.1.10-1ubuntu2.4_powerpc.deb
      Size/MD5:   708452 e2cd64600d8b68b25481056dc593134d
    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.1.10-1ubuntu2.4_powerpc.udeb
      Size/MD5:   241430 343d42465b75dfbde9c8b673b63f95a8
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.1.10-1ubuntu2.4_powerpc.deb
      Size/MD5:   429912 f2c726e22fb41ef27df711c7e6fd9ab0

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.1.10-1ubuntu2.4_sparc.deb
      Size/MD5:   120086 248ac4cef1bad3d365d9b606bfd14250
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.1.10-1ubuntu2.4_sparc.deb
      Size/MD5:   683604 ed161a065832858b3b5f38337fedede4
    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.1.10-1ubuntu2.4_sparc.udeb
      Size/MD5:   222412 88abfd04c48284822aefdc54dc097051
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.1.10-1ubuntu2.4_sparc.deb
      Size/MD5:   410924 e65f370c80a2cbdaec13ab6ebc4757b6

Updated packages for Ubuntu 6.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.2.1-5ubuntu0.2.diff.gz
      Size/MD5:    32666 84703fa6c7764f7cd71c2520a20bae1a
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.2.1-5ubuntu0.2.dsc
      Size/MD5:      804 0dee04028b217f99d6e3db96ce103a32
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.2.1.orig.tar.gz
      Size/MD5:  1451392 a584e84d617c6e7919b4aef9b5106cf4

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.2.1-5ubuntu0.2_amd64.deb
      Size/MD5:   150938 1adc232371924b165fe4250faf907777
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.2.1-5ubuntu0.2_amd64.deb
      Size/MD5:   668910 bb74d8aaf81a7330c92cebeb0c957995
    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.2.1-5ubuntu0.2_amd64.udeb
      Size/MD5:   248242 307ab8aec1e64fc33890a0c5b8c8a3c1
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.2.1-5ubuntu0.2_amd64.deb
      Size/MD5:   353722 5b9d780cf628bfd95478fe1acc4039c7

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.2.1-5ubuntu0.2_i386.deb
      Size/MD5:   134028 b8e9d12d2c50847caae831d4d03c7e41
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.2.1-5ubuntu0.2_i386.deb
      Size/MD5:   640498 3069589c396a42d8a43ce1f6e3788850
    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.2.1-5ubuntu0.2_i386.udeb
      Size/MD5:   235386 0169fcc454aa7fce6ff4c3a0e41cf039
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.2.1-5ubuntu0.2_i386.deb
      Size/MD5:   341268 e487d48744b095833bb4f348b3ba26de

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.2.1-5ubuntu0.2_powerpc.deb
      Size/MD5:   148590 6d3c2f406e7633339dd22a523ac3510d
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.2.1-5ubuntu0.2_powerpc.deb
      Size/MD5:   663372 742576227586b665da5b25b3f3e6e211
    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.2.1-5ubuntu0.2_powerpc.udeb
      Size/MD5:   241588 7535438d79f675393ba13651dd08e198
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.2.1-5ubuntu0.2_powerpc.deb
      Size/MD5:   346822 fe6ec72589bd9cb4d7e087a7d5180c46

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.2.1-5ubuntu0.2_sparc.deb
      Size/MD5:   131802 70e419ec75d1d774ff2e859ab93245b6
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.2.1-5ubuntu0.2_sparc.deb
      Size/MD5:   635930 d9194530eb145529e99082fb199d312a
    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.2.1-5ubuntu0.2_sparc.udeb
      Size/MD5:   220156 74edcdadc4e59175f940853d18aa3974
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.2.1-5ubuntu0.2_sparc.deb
      Size/MD5:   325486 541079cd6854f80c0fbe88082c7307fb

Updated packages for Ubuntu 7.04:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.2.1-5ubuntu1.1.diff.gz
      Size/MD5:    32706 0d87e07b023727769097cac344ce513e
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.2.1-5ubuntu1.1.dsc
      Size/MD5:      888 ca1f0736f3bc26a20cb01bc72b9b50c7
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.2.1.orig.tar.gz
      Size/MD5:  1451392 a584e84d617c6e7919b4aef9b5106cf4

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.2.1-5ubuntu1.1_amd64.deb
      Size/MD5:   151700 c23606b077fad4519cc1ec9576968773
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.2.1-5ubuntu1.1_amd64.deb
      Size/MD5:   669110 238cc0092b12ddc15c9db056a9588e82
    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.2.1-5ubuntu1.1_amd64.udeb
      Size/MD5:   250826 73ca6d7f452e62744f2f9575cdb1edcb
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.2.1-5ubuntu1.1_amd64.deb
      Size/MD5:   355778 346185d46c270ec4e5aec716fd74bb95

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.2.1-5ubuntu1.1_i386.deb
      Size/MD5:   134588 d70bcb4a70cab325310cbbcbd4bf85f4
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.2.1-5ubuntu1.1_i386.deb
      Size/MD5:   640452 b625b731b74e8d3fa3f40dbea78042f1
    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.2.1-5ubuntu1.1_i386.udeb
      Size/MD5:   237514 8c255ad79ef3a5b420faadc20d52e586
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.2.1-5ubuntu1.1_i386.deb
      Size/MD5:   343704 8bb21ece4c6fdf9f7b21b47851738aae

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.2.1-5ubuntu1.1_powerpc.deb
      Size/MD5:   160368 d9e4644037ec704c5fb14ba01458621a
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.2.1-5ubuntu1.1_powerpc.deb
      Size/MD5:   663182 d5f0c7842322dfb48bf2d408dbb4090b
    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.2.1-5ubuntu1.1_powerpc.udeb
      Size/MD5:   250198 ef6b98638ce9ecaec418b7a70953a18a
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.2.1-5ubuntu1.1_powerpc.deb
      Size/MD5:   356344 eee332a33ba7f78bcbcab97eafa63044

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.2.1-5ubuntu1.1_sparc.deb
      Size/MD5:   135444 724fdf4d6e23c0a137f6da3444055865
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.2.1-5ubuntu1.1_sparc.deb
      Size/MD5:   635760 c45da9c957bf5f373f500a6eaf3d6cb5
    http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.2.1-5ubuntu1.1_sparc.udeb
      Size/MD5:   222252 8c7395e7566bdfa70396f2b5013f65be
    http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.2.1-5ubuntu1.1_sparc.deb
      Size/MD5:   327906 019da2a4862009540edddfdb14581582


Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)

Powered by blists - more mailing lists