Your message dated Fri, 24 Apr 2009 16:47:04 +0000
with message-id <e1lxoyk-0004hl...@ries.debian.org>
and subject line Bug#524925: fixed in freetype 2.3.9-4.1
has caused the Debian Bug report #524925,
regarding freetype: multiple integer overflows
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
524925: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=524925
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: freetype
Severity: grave
Tags: security patch
Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for freetype.
CVE-2009-0946[0]:
| Multiple integer overflows in FreeType 2.3.9 and earlier allow remote
| attackers to execute arbitrary code via vectors related to large
| values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c,
| and (3) cff/cffload.c.
If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.
The upstream patches for this are:
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=79972af4f0485a11dcb19551356c45245749fc5b
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=a18788b14db60ae3673f932249cd02d33a227c4e
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0a05ba257b6ddd87dacf8d54b626e4b360e0a596
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0545ec1ca36b27cb928128870a83e5f668980bc5
I can provide test-cases for these bugs in private if you need them.
For further information see:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0946
http://security-tracker.debian.net/tracker/CVE-2009-0946
--
Nico Golde - http://www.ngolde.de - n...@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.
pgpXjqrcOLVoo.pgp
Description: PGP signature
--- End Message ---
--- Begin Message ---
Source: freetype
Source-Version: 2.3.9-4.1
We believe that the bug you reported is fixed in the latest version of
freetype, which is due to be installed in the Debian FTP archive:
freetype2-demos_2.3.9-4.1_amd64.deb
to pool/main/f/freetype/freetype2-demos_2.3.9-4.1_amd64.deb
freetype_2.3.9-4.1.diff.gz
to pool/main/f/freetype/freetype_2.3.9-4.1.diff.gz
freetype_2.3.9-4.1.dsc
to pool/main/f/freetype/freetype_2.3.9-4.1.dsc
libfreetype6-dev_2.3.9-4.1_amd64.deb
to pool/main/f/freetype/libfreetype6-dev_2.3.9-4.1_amd64.deb
libfreetype6-udeb_2.3.9-4.1_amd64.udeb
to pool/main/f/freetype/libfreetype6-udeb_2.3.9-4.1_amd64.udeb
libfreetype6_2.3.9-4.1_amd64.deb
to pool/main/f/freetype/libfreetype6_2.3.9-4.1_amd64.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 524...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Nico Golde <n...@debian.org> (supplier of updated freetype package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Thu, 23 Apr 2009 21:13:11 +0200
Source: freetype
Binary: libfreetype6 libfreetype6-dev freetype2-demos libfreetype6-udeb
Architecture: source amd64
Version: 2.3.9-4.1
Distribution: unstable
Urgency: high
Maintainer: Steve Langasek <vor...@debian.org>
Changed-By: Nico Golde <n...@debian.org>
Description:
freetype2-demos - FreeType 2 demonstration programs
libfreetype6 - FreeType 2 font engine, shared library files
libfreetype6-dev - FreeType 2 font engine, development files
libfreetype6-udeb - FreeType 2 font engine for the debian-installer (udeb)
Closes: 524925
Changes:
freetype (2.3.9-4.1) unstable; urgency=high
.
* Non-maintainer upload by the Security Team.
* Fix multiple integer overflows leading to arbitrary code execution
or DoS (CVE-2009-0946; Closes: #524925).
Checksums-Sha1:
f3a29af391bbae57481e3e8305917725af86bcfa 1198 freetype_2.3.9-4.1.dsc
8f063f0b3d62617afce6a44172a7e1d3b1e3bca1 36099 freetype_2.3.9-4.1.diff.gz
221814325582604d5601cc9cdcbb84c310da4681 409326
libfreetype6_2.3.9-4.1_amd64.deb
31a6bd4e4382d62c4244d1823b0577c8dd282248 728638
libfreetype6-dev_2.3.9-4.1_amd64.deb
f08f1d1ed36a32e5935de97dfd5137797025c456 222282
freetype2-demos_2.3.9-4.1_amd64.deb
2585517b9a54eab917d0b77b0c6b4a0870cb83d5 274930
libfreetype6-udeb_2.3.9-4.1_amd64.udeb
Checksums-Sha256:
f6cba845d2aa218066f19bfb4cee5ea1a2e2774727d65f487e515b8d8d5dc452 1198
freetype_2.3.9-4.1.dsc
b522b308e3093d49120fa790a63ff29e0908e437c7ba4f919822c62ca538fab1 36099
freetype_2.3.9-4.1.diff.gz
bb825f1bfc9f17dc986f6692a0519769a9ccbaece41e6e4431309d2dc03d75d7 409326
libfreetype6_2.3.9-4.1_amd64.deb
f4fa0f589c5811affff737dc1e1554bc073d91b6e045d3ea3d520e61c5b9e589 728638
libfreetype6-dev_2.3.9-4.1_amd64.deb
2f5c5a53a8bc347bd4f4be147d154a8b1935c552c20e17818c51793ac538cf50 222282
freetype2-demos_2.3.9-4.1_amd64.deb
c751299d75052266e6f7dc46ad2a1dd3b4a78f1a209aeba3b777d1beb20afd5c 274930
libfreetype6-udeb_2.3.9-4.1_amd64.udeb
Files:
1ab634ac6dd213cb56dfe4b5804f5a67 1198 libs optional freetype_2.3.9-4.1.dsc
66f7778d4059f847c7055c667d6a4da7 36099 libs optional freetype_2.3.9-4.1.diff.gz
aa236c5d644d172a59d0f1ee317b4110 409326 libs optional
libfreetype6_2.3.9-4.1_amd64.deb
18c61df9d3cc61bedaa2391dea504ac4 728638 libdevel optional
libfreetype6-dev_2.3.9-4.1_amd64.deb
9a2c5dedb377fa19edb591dafd8577b1 222282 utils optional
freetype2-demos_2.3.9-4.1_amd64.deb
d3537f67bbf9905115b4ad7887497fb0 274930 debian-installer extra
libfreetype6-udeb_2.3.9-4.1_amd64.udeb
Package-Type: udeb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAknx6d4ACgkQHYflSXNkfP8HJwCghAF3JarpU+Kd4By9ClNaVPEu
3sYAoKXqbL27F4h54chC11lAQKudZH5b
=GZv6
-----END PGP SIGNATURE-----
--- End Message ---
