bugThe FreeType Project - Bugs: bug #27472, Latest release includes...

 
 

bug #27472: Latest release includes vulnerabilities

Submitted by:  Sylvain Beucler <Beuc>
Submitted on:  Thu 17 Sep 2009 06:35:57 PM UTC  
 
Severity: 3 - NormalItem Group: None
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.3.10

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 21 Sep 2009 06:09:27 AM UTC, comment #3:

Regard these CVEs in FreeType: I haven't heard of someone actually trying to use those vulnerabilities you are citing. They simply cause a crash in the FreeType library but don't allow to execute arbitrary code (which would be really dangerous). It's quite an amount of work to actually construct a font which makes FreeType crash since almost everything is binary data, and the involved objects would be rather huge (very untypically for non-CJK fonts).

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Fri 18 Sep 2009 11:32:54 AM UTC, comment #2:

> IIRC, I wasn't informed about the CVEs. Thanks for this.


They match:
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/patch/?id=79972af4f0485a11dcb19551356c45245749fc5b
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/patch/?id=a18788b14db60ae3673f932249cd02d33a227c4e
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/patch/?id=0a05ba257b6ddd87dacf8d54b626e4b360e0a596
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/patch/?id=0545ec1ca36b27cb928128870a83e5f668980bc5

AFAIK distros just included those commits in their packages.
They apply cleanly if you exclude ChangeLog - which is what I did too.

> We are going to do a new release quite soon. In case you
> don't rely on compiling FreeType with a C++ compiler,
> simply use the current git version.


I think there's a problem with this solution.

Let me explain the way I work:
- I prepare a new release for my project
- I bundle a few dependencies for some platforms, in particular for ms woe and psp
- Before I do so I check that I have the latest releases of these dependencies

So I don't use a Git (not tested) version, and I suppose that the latest release do not have known security issues.

Thus, if the dependency maintainers assume that I either use the unstable version or wait for the next version, and do not update the latest release, then I'll just distribute flawed versions of that dependency. (here I knew about the CVE only by chance)

Does that make sense, or am I overestimating the gravity of the CVE? :)

Sylvain Beucler <Beuc>
Fri 18 Sep 2009 08:59:06 AM UTC, comment #1:

IIRC, I wasn't informed about the CVEs. Thanks for this.

We are going to do a new release quite soon. In case you don't rely on compiling FreeType with a C++ compiler, simply use the current git version.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Thu 17 Sep 2009 06:35:57 PM UTC, original submission:

Hi,

According to:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0946
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=524925
FreeType 2.3.9 has a few security flaws, published last April.

When downloading the latest version of FreeType so as to cross-compile GNU FreeDink, I'd expect that known security issues are addressed in the latest release, so I'm surprised.

Did I miss something?

Regards,

Sylvain Beucler <Beuc>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by Beuc (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 18 Oct 2009 08:19:54 AM UTCwlOpen/ClosedOpen=>Closed
    Fri 18 Sep 2009 08:59:06 AM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Planned ReleaseNone=>2.3.10

    Back to the top


    Powered by Savane 3.1-cleanup1