Issued:
2006-07-18
Updated:
2006-07-18

RHSA-2006:0500 - Security Advisory

Synopsis

freetype security update

Type/Severity

Security Advisory: Moderate

Topic

Updated freetype packages that fix several security flaws are now available
for Red Hat Enterprise Linux.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

FreeType is a free, high-quality, and portable font engine.

Chris Evans discovered several integer underflow and overflow flaws in the
FreeType font engine. If a user loads a carefully crafted font file with a
program linked against FreeType, it could cause the application to crash or
execute arbitrary code as the user. While it is uncommon for a user to
explicitly load a font file, there are several application file formats
which contain embedded fonts that are parsed by FreeType. (CVE-2006-0747,
CVE-2006-1861, CVE-2006-3467)

A NULL pointer dereference flaw was found in the FreeType font engine. An
application linked against FreeType can crash upon loading a malformed font
file. (CVE-2006-2661)

Users of FreeType should upgrade to these updated packages, which contain
backported patches to correct these issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

  • Red Hat Enterprise Linux Server 4 x86_64
  • Red Hat Enterprise Linux Server 4 ia64
  • Red Hat Enterprise Linux Server 4 i386
  • Red Hat Enterprise Linux Server 3 x86_64
  • Red Hat Enterprise Linux Server 3 ia64
  • Red Hat Enterprise Linux Server 3 i386
  • Red Hat Enterprise Linux Server 2 ia64
  • Red Hat Enterprise Linux Server 2 i386
  • Red Hat Enterprise Linux Workstation 4 x86_64
  • Red Hat Enterprise Linux Workstation 4 ia64
  • Red Hat Enterprise Linux Workstation 4 i386
  • Red Hat Enterprise Linux Workstation 3 x86_64
  • Red Hat Enterprise Linux Workstation 3 ia64
  • Red Hat Enterprise Linux Workstation 3 i386
  • Red Hat Enterprise Linux Workstation 2 ia64
  • Red Hat Enterprise Linux Workstation 2 i386
  • Red Hat Enterprise Linux Desktop 4 x86_64
  • Red Hat Enterprise Linux Desktop 4 i386
  • Red Hat Enterprise Linux Desktop 3 x86_64
  • Red Hat Enterprise Linux Desktop 3 i386
  • Red Hat Enterprise Linux for IBM z Systems 4 s390x
  • Red Hat Enterprise Linux for IBM z Systems 4 s390
  • Red Hat Enterprise Linux for IBM z Systems 3 s390x
  • Red Hat Enterprise Linux for IBM z Systems 3 s390
  • Red Hat Enterprise Linux for Power, big endian 4 ppc
  • Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

  • BZ - 183676 - CVE-2006-0747 Freetype integer underflow (CVE-2006-2661)
  • BZ - 190593 - CVE-2006-1861 freetype multiple integer overflows (CVE-2006-3467)

CVEs

References

Red Hat Enterprise Linux Server 4

SRPM
x86_64
freetype-2.1.9-1.rhel4.4.i386.rpm SHA-256: 62d70a31dbeca6fd84501d10e6d2f1e4420b0325492ba02323cdb0ac3b999706
freetype-2.1.9-1.rhel4.4.i386.rpm SHA-256: 62d70a31dbeca6fd84501d10e6d2f1e4420b0325492ba02323cdb0ac3b999706
freetype-2.1.9-1.rhel4.4.x86_64.rpm SHA-256: 5145c39ce47ea076a7c918dd973928327d42ba8ca0f12f7e2d5fffc39af4980e
freetype-2.1.9-1.rhel4.4.x86_64.rpm SHA-256: 5145c39ce47ea076a7c918dd973928327d42ba8ca0f12f7e2d5fffc39af4980e
freetype-demos-2.1.9-1.rhel4.4.x86_64.rpm SHA-256: 00d258249c82081916a587885775bfd0a12cce69cb728a91d0f2d1702787ea6b
freetype-demos-2.1.9-1.rhel4.4.x86_64.rpm SHA-256: 00d258249c82081916a587885775bfd0a12cce69cb728a91d0f2d1702787ea6b
freetype-devel-2.1.9-1.rhel4.4.x86_64.rpm SHA-256: 41f7e1ee63420e9e21fa574784dd344b498f97699d63a91839797d0e1d7d6414
freetype-devel-2.1.9-1.rhel4.4.x86_64.rpm SHA-256: 41f7e1ee63420e9e21fa574784dd344b498f97699d63a91839797d0e1d7d6414
freetype-utils-2.1.9-1.rhel4.4.x86_64.rpm SHA-256: c39f6a53a9d9199bb28e4de89e4a77fa22bbc91ef0e591a6660180ea6740e462
freetype-utils-2.1.9-1.rhel4.4.x86_64.rpm SHA-256: c39f6a53a9d9199bb28e4de89e4a77fa22bbc91ef0e591a6660180ea6740e462
ia64
freetype-2.1.9-1.rhel4.4.i386.rpm SHA-256: 62d70a31dbeca6fd84501d10e6d2f1e4420b0325492ba02323cdb0ac3b999706
freetype-2.1.9-1.rhel4.4.i386.rpm SHA-256: 62d70a31dbeca6fd84501d10e6d2f1e4420b0325492ba02323cdb0ac3b999706
freetype-2.1.9-1.rhel4.4.ia64.rpm SHA-256: 7615935345ba7b5fd96dd51f3a59408349bfb71bad76a89dde47880fc7f0e443
freetype-2.1.9-1.rhel4.4.ia64.rpm SHA-256: 7615935345ba7b5fd96dd51f3a59408349bfb71bad76a89dde47880fc7f0e443
freetype-demos-2.1.9-1.rhel4.4.ia64.rpm SHA-256: 125d7badff13114ca0ff1c7024dd7e54360407fffa3b925d245b185a0ddf6d29
freetype-demos-2.1.9-1.rhel4.4.ia64.rpm SHA-256: 125d7badff13114ca0ff1c7024dd7e54360407fffa3b925d245b185a0ddf6d29
freetype-devel-2.1.9-1.rhel4.4.ia64.rpm SHA-256: 602d954da72512dd445d65f968056e3c6d891a56de292237af142afb8675b280
freetype-devel-2.1.9-1.rhel4.4.ia64.rpm SHA-256: 602d954da72512dd445d65f968056e3c6d891a56de292237af142afb8675b280
freetype-utils-2.1.9-1.rhel4.4.ia64.rpm SHA-256: b513f1018018d04fff047082a2cedc77b7aa2e79a88415532f6675360ba8a2f1
freetype-utils-2.1.9-1.rhel4.4.ia64.rpm SHA-256: b513f1018018d04fff047082a2cedc77b7aa2e79a88415532f6675360ba8a2f1
i386
freetype-2.1.9-1.rhel4.4.i386.rpm SHA-256: 62d70a31dbeca6fd84501d10e6d2f1e4420b0325492ba02323cdb0ac3b999706
freetype-2.1.9-1.rhel4.4.i386.rpm SHA-256: 62d70a31dbeca6fd84501d10e6d2f1e4420b0325492ba02323cdb0ac3b999706
freetype-demos-2.1.9-1.rhel4.4.i386.rpm SHA-256: d1477d069c20bd1334f4505df81aa3b77899c2cef628b7bba4bbcc81a6377ee8
freetype-demos-2.1.9-1.rhel4.4.i386.rpm SHA-256: d1477d069c20bd1334f4505df81aa3b77899c2cef628b7bba4bbcc81a6377ee8
freetype-devel-2.1.9-1.rhel4.4.i386.rpm SHA-256: d5131ab7fc0768df646019171c5aeaad2a19cd11695d4c8775e0020c667b24a1
freetype-devel-2.1.9-1.rhel4.4.i386.rpm SHA-256: d5131ab7fc0768df646019171c5aeaad2a19cd11695d4c8775e0020c667b24a1
freetype-utils-2.1.9-1.rhel4.4.i386.rpm SHA-256: 84e664e6c1566ed10f355c9ed7ca48d67557c29582b12cda94d597ad65ce9377
freetype-utils-2.1.9-1.rhel4.4.i386.rpm SHA-256: 84e664e6c1566ed10f355c9ed7ca48d67557c29582b12cda94d597ad65ce9377

Red Hat Enterprise Linux Workstation 4

SRPM
x86_64
freetype-2.1.9-1.rhel4.4.i386.rpm SHA-256: 62d70a31dbeca6fd84501d10e6d2f1e4420b0325492ba02323cdb0ac3b999706
freetype-2.1.9-1.rhel4.4.x86_64.rpm SHA-256: 5145c39ce47ea076a7c918dd973928327d42ba8ca0f12f7e2d5fffc39af4980e
freetype-demos-2.1.9-1.rhel4.4.x86_64.rpm SHA-256: 00d258249c82081916a587885775bfd0a12cce69cb728a91d0f2d1702787ea6b
freetype-devel-2.1.9-1.rhel4.4.x86_64.rpm SHA-256: 41f7e1ee63420e9e21fa574784dd344b498f97699d63a91839797d0e1d7d6414
freetype-utils-2.1.9-1.rhel4.4.x86_64.rpm SHA-256: c39f6a53a9d9199bb28e4de89e4a77fa22bbc91ef0e591a6660180ea6740e462
ia64
freetype-2.1.9-1.rhel4.4.i386.rpm SHA-256: 62d70a31dbeca6fd84501d10e6d2f1e4420b0325492ba02323cdb0ac3b999706
freetype-2.1.9-1.rhel4.4.ia64.rpm SHA-256: 7615935345ba7b5fd96dd51f3a59408349bfb71bad76a89dde47880fc7f0e443
freetype-demos-2.1.9-1.rhel4.4.ia64.rpm SHA-256: 125d7badff13114ca0ff1c7024dd7e54360407fffa3b925d245b185a0ddf6d29
freetype-devel-2.1.9-1.rhel4.4.ia64.rpm SHA-256: 602d954da72512dd445d65f968056e3c6d891a56de292237af142afb8675b280
freetype-utils-2.1.9-1.rhel4.4.ia64.rpm SHA-256: b513f1018018d04fff047082a2cedc77b7aa2e79a88415532f6675360ba8a2f1
i386
freetype-2.1.9-1.rhel4.4.i386.rpm SHA-256: 62d70a31dbeca6fd84501d10e6d2f1e4420b0325492ba02323cdb0ac3b999706
freetype-demos-2.1.9-1.rhel4.4.i386.rpm SHA-256: d1477d069c20bd1334f4505df81aa3b77899c2cef628b7bba4bbcc81a6377ee8
freetype-devel-2.1.9-1.rhel4.4.i386.rpm SHA-256: d5131ab7fc0768df646019171c5aeaad2a19cd11695d4c8775e0020c667b24a1
freetype-utils-2.1.9-1.rhel4.4.i386.rpm SHA-256: 84e664e6c1566ed10f355c9ed7ca48d67557c29582b12cda94d597ad65ce9377

Red Hat Enterprise Linux Desktop 4

SRPM
x86_64
freetype-2.1.9-1.rhel4.4.i386.rpm SHA-256: 62d70a31dbeca6fd84501d10e6d2f1e4420b0325492ba02323cdb0ac3b999706
freetype-2.1.9-1.rhel4.4.x86_64.rpm SHA-256: 5145c39ce47ea076a7c918dd973928327d42ba8ca0f12f7e2d5fffc39af4980e
freetype-demos-2.1.9-1.rhel4.4.x86_64.rpm SHA-256: 00d258249c82081916a587885775bfd0a12cce69cb728a91d0f2d1702787ea6b
freetype-devel-2.1.9-1.rhel4.4.x86_64.rpm SHA-256: 41f7e1ee63420e9e21fa574784dd344b498f97699d63a91839797d0e1d7d6414
freetype-utils-2.1.9-1.rhel4.4.x86_64.rpm SHA-256: c39f6a53a9d9199bb28e4de89e4a77fa22bbc91ef0e591a6660180ea6740e462
i386
freetype-2.1.9-1.rhel4.4.i386.rpm SHA-256: 62d70a31dbeca6fd84501d10e6d2f1e4420b0325492ba02323cdb0ac3b999706
freetype-demos-2.1.9-1.rhel4.4.i386.rpm SHA-256: d1477d069c20bd1334f4505df81aa3b77899c2cef628b7bba4bbcc81a6377ee8
freetype-devel-2.1.9-1.rhel4.4.i386.rpm SHA-256: d5131ab7fc0768df646019171c5aeaad2a19cd11695d4c8775e0020c667b24a1
freetype-utils-2.1.9-1.rhel4.4.i386.rpm SHA-256: 84e664e6c1566ed10f355c9ed7ca48d67557c29582b12cda94d597ad65ce9377

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
s390x
freetype-2.1.9-1.rhel4.4.s390.rpm SHA-256: ce26383c383123dc8d27100ca3508adef1e505fbdbec5d3cd90103b7c63ab4be
freetype-2.1.9-1.rhel4.4.s390x.rpm SHA-256: 74d1c600bd9e4c5e1d4f294a76c923453bb8746e7cd85ba928b92d374a97bcfc
freetype-demos-2.1.9-1.rhel4.4.s390x.rpm SHA-256: a0008a7a2abea9a4e8ac1c1a46d78b99ae3fbef0534c9ee33feb9fd5aa5f6bc7
freetype-devel-2.1.9-1.rhel4.4.s390x.rpm SHA-256: 672bf96424bf08399d43c965cc05a945cf3ad66b14214b3650da08129264c81c
freetype-utils-2.1.9-1.rhel4.4.s390x.rpm SHA-256: b6effa0022bee88fcc65b04dd5703f40e4e6d671e075f33669c916bd9dad9fa8
s390
freetype-2.1.9-1.rhel4.4.s390.rpm SHA-256: ce26383c383123dc8d27100ca3508adef1e505fbdbec5d3cd90103b7c63ab4be
freetype-demos-2.1.9-1.rhel4.4.s390.rpm SHA-256: b9d4bd374f7c4649a4d9ad433ff694d3ed3c90a7b14b50a5f03efb6b751994c7
freetype-devel-2.1.9-1.rhel4.4.s390.rpm SHA-256: ef08d9ac01c0b0a501c91d5273bb1f6810d22f1d7a7c085b33775e197e7016fd
freetype-utils-2.1.9-1.rhel4.4.s390.rpm SHA-256: 4f9a510781cfa9886ad5532f7653f7672a30f5b33d6fe3a496765b2308e2d961

Red Hat Enterprise Linux for Power, big endian 4

SRPM
ppc
freetype-2.1.9-1.rhel4.4.ppc.rpm SHA-256: 465e1854d84b410fc9c2e87197567a7e9027f7c20807b241bf99a58c8f178853
freetype-2.1.9-1.rhel4.4.ppc64.rpm SHA-256: 955fd8b9d90814f8e5952afb7c46ba668b155c3f0a05a6247a0aec3173c52a46
freetype-demos-2.1.9-1.rhel4.4.ppc.rpm SHA-256: d156d40e98bd046e21d3856afb610c288b8d92693f22e1032934f38e9e924421
freetype-devel-2.1.9-1.rhel4.4.ppc.rpm SHA-256: 02dcb75bfacd6bcd9ed121fc08d49f702d1e395f35bf6a9991ecbb3b455ae59c
freetype-utils-2.1.9-1.rhel4.4.ppc.rpm SHA-256: a5e6acbd4f5a840e8e887df2d782b4ad70ab706cc85104a8704b52b0cabd8c86

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.