| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20070530224527.GP14736@outflux.net>
Date: Wed, 30 May 2007 15:45:27 -0700
From: Kees Cook <kees@...ntu.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-466-1] freetype vulnerability
===========================================================
Ubuntu Security Notice USN-466-1 May 30, 2007
freetype vulnerability
CVE-2007-2754
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 6.06 LTS
Ubuntu 6.10
Ubuntu 7.04
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 6.06 LTS:
libfreetype6 2.1.10-1ubuntu2.4
Ubuntu 6.10:
libfreetype6 2.2.1-5ubuntu0.2
Ubuntu 7.04:
libfreetype6 2.2.1-5ubuntu1.1
After a standard system upgrade you need to restart your session or
reboot your computer to effect the necessary changes.
Details follow:
Victor Stinner discovered that freetype did not correctly verify the
number of points in a TrueType font. If a user were tricked into using
a specially crafted font, a remote attacker could execute arbitrary code
with user privileges.
Updated packages for Ubuntu 6.06 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.1.10-1ubuntu2.4.diff.gz
Size/MD5: 59961 56e423eaba2a421a4dc629c001b0c0e9
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.1.10-1ubuntu2.4.dsc
Size/MD5: 710 78cf6cb2c7bdbb66e3cb1defeb776070
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.1.10.orig.tar.gz
Size/MD5: 1323617 adf145ce51196ad1b3054d5fb032efe6
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.1.10-1ubuntu2.4_amd64.deb
Size/MD5: 133862 208fb4911a69f8531372987f67c160ec
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.1.10-1ubuntu2.4_amd64.deb
Size/MD5: 717436 0c4e3ee7c34df9826e78a7d8b6304575
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.1.10-1ubuntu2.4_amd64.udeb
Size/MD5: 251696 b150010bbc91b7ceb0b57e2e957d9f95
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.1.10-1ubuntu2.4_amd64.deb
Size/MD5: 439866 9b1000f03c7402102b55359cf8d7bba1
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.1.10-1ubuntu2.4_i386.deb
Size/MD5: 117358 2860f31f56af3bc7eb31b7d51667f0ac
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.1.10-1ubuntu2.4_i386.deb
Size/MD5: 677462 51565ff05b8ec83f9ff1ba87420ebb8f
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.1.10-1ubuntu2.4_i386.udeb
Size/MD5: 227276 675ea7a2a54d35647f9e7287c1a53ee7
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.1.10-1ubuntu2.4_i386.deb
Size/MD5: 415436 73043a17a766bedfd6a90fb8f1415020
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.1.10-1ubuntu2.4_powerpc.deb
Size/MD5: 134244 73174f9b2b4defd227890c9b41d8baef
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.1.10-1ubuntu2.4_powerpc.deb
Size/MD5: 708452 e2cd64600d8b68b25481056dc593134d
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.1.10-1ubuntu2.4_powerpc.udeb
Size/MD5: 241430 343d42465b75dfbde9c8b673b63f95a8
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.1.10-1ubuntu2.4_powerpc.deb
Size/MD5: 429912 f2c726e22fb41ef27df711c7e6fd9ab0
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.1.10-1ubuntu2.4_sparc.deb
Size/MD5: 120086 248ac4cef1bad3d365d9b606bfd14250
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.1.10-1ubuntu2.4_sparc.deb
Size/MD5: 683604 ed161a065832858b3b5f38337fedede4
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.1.10-1ubuntu2.4_sparc.udeb
Size/MD5: 222412 88abfd04c48284822aefdc54dc097051
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.1.10-1ubuntu2.4_sparc.deb
Size/MD5: 410924 e65f370c80a2cbdaec13ab6ebc4757b6
Updated packages for Ubuntu 6.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.2.1-5ubuntu0.2.diff.gz
Size/MD5: 32666 84703fa6c7764f7cd71c2520a20bae1a
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.2.1-5ubuntu0.2.dsc
Size/MD5: 804 0dee04028b217f99d6e3db96ce103a32
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.2.1.orig.tar.gz
Size/MD5: 1451392 a584e84d617c6e7919b4aef9b5106cf4
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.2.1-5ubuntu0.2_amd64.deb
Size/MD5: 150938 1adc232371924b165fe4250faf907777
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.2.1-5ubuntu0.2_amd64.deb
Size/MD5: 668910 bb74d8aaf81a7330c92cebeb0c957995
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.2.1-5ubuntu0.2_amd64.udeb
Size/MD5: 248242 307ab8aec1e64fc33890a0c5b8c8a3c1
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.2.1-5ubuntu0.2_amd64.deb
Size/MD5: 353722 5b9d780cf628bfd95478fe1acc4039c7
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.2.1-5ubuntu0.2_i386.deb
Size/MD5: 134028 b8e9d12d2c50847caae831d4d03c7e41
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.2.1-5ubuntu0.2_i386.deb
Size/MD5: 640498 3069589c396a42d8a43ce1f6e3788850
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.2.1-5ubuntu0.2_i386.udeb
Size/MD5: 235386 0169fcc454aa7fce6ff4c3a0e41cf039
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.2.1-5ubuntu0.2_i386.deb
Size/MD5: 341268 e487d48744b095833bb4f348b3ba26de
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.2.1-5ubuntu0.2_powerpc.deb
Size/MD5: 148590 6d3c2f406e7633339dd22a523ac3510d
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.2.1-5ubuntu0.2_powerpc.deb
Size/MD5: 663372 742576227586b665da5b25b3f3e6e211
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.2.1-5ubuntu0.2_powerpc.udeb
Size/MD5: 241588 7535438d79f675393ba13651dd08e198
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.2.1-5ubuntu0.2_powerpc.deb
Size/MD5: 346822 fe6ec72589bd9cb4d7e087a7d5180c46
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.2.1-5ubuntu0.2_sparc.deb
Size/MD5: 131802 70e419ec75d1d774ff2e859ab93245b6
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.2.1-5ubuntu0.2_sparc.deb
Size/MD5: 635930 d9194530eb145529e99082fb199d312a
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.2.1-5ubuntu0.2_sparc.udeb
Size/MD5: 220156 74edcdadc4e59175f940853d18aa3974
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.2.1-5ubuntu0.2_sparc.deb
Size/MD5: 325486 541079cd6854f80c0fbe88082c7307fb
Updated packages for Ubuntu 7.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.2.1-5ubuntu1.1.diff.gz
Size/MD5: 32706 0d87e07b023727769097cac344ce513e
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.2.1-5ubuntu1.1.dsc
Size/MD5: 888 ca1f0736f3bc26a20cb01bc72b9b50c7
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/freetype_2.2.1.orig.tar.gz
Size/MD5: 1451392 a584e84d617c6e7919b4aef9b5106cf4
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.2.1-5ubuntu1.1_amd64.deb
Size/MD5: 151700 c23606b077fad4519cc1ec9576968773
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.2.1-5ubuntu1.1_amd64.deb
Size/MD5: 669110 238cc0092b12ddc15c9db056a9588e82
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.2.1-5ubuntu1.1_amd64.udeb
Size/MD5: 250826 73ca6d7f452e62744f2f9575cdb1edcb
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.2.1-5ubuntu1.1_amd64.deb
Size/MD5: 355778 346185d46c270ec4e5aec716fd74bb95
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.2.1-5ubuntu1.1_i386.deb
Size/MD5: 134588 d70bcb4a70cab325310cbbcbd4bf85f4
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.2.1-5ubuntu1.1_i386.deb
Size/MD5: 640452 b625b731b74e8d3fa3f40dbea78042f1
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.2.1-5ubuntu1.1_i386.udeb
Size/MD5: 237514 8c255ad79ef3a5b420faadc20d52e586
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.2.1-5ubuntu1.1_i386.deb
Size/MD5: 343704 8bb21ece4c6fdf9f7b21b47851738aae
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.2.1-5ubuntu1.1_powerpc.deb
Size/MD5: 160368 d9e4644037ec704c5fb14ba01458621a
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.2.1-5ubuntu1.1_powerpc.deb
Size/MD5: 663182 d5f0c7842322dfb48bf2d408dbb4090b
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.2.1-5ubuntu1.1_powerpc.udeb
Size/MD5: 250198 ef6b98638ce9ecaec418b7a70953a18a
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.2.1-5ubuntu1.1_powerpc.deb
Size/MD5: 356344 eee332a33ba7f78bcbcab97eafa63044
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/freetype2-demos_2.2.1-5ubuntu1.1_sparc.deb
Size/MD5: 135444 724fdf4d6e23c0a137f6da3444055865
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6-dev_2.2.1-5ubuntu1.1_sparc.deb
Size/MD5: 635760 c45da9c957bf5f373f500a6eaf3d6cb5
http://security.ubuntu.com/ubuntu/pool/universe/f/freetype/libfreetype6-udeb_2.2.1-5ubuntu1.1_sparc.udeb
Size/MD5: 222252 8c7395e7566bdfa70396f2b5013f65be
http://security.ubuntu.com/ubuntu/pool/main/f/freetype/libfreetype6_2.2.1-5ubuntu1.1_sparc.deb
Size/MD5: 327906 019da2a4862009540edddfdb14581582
Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists