Synopsis

Moderate: freetype security update

Type/Severity

Security Advisory: Moderate

Topic

Updated freetype packages that fix a security flaw are now available for Red
Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

FreeType is a free, high-quality, portable font engine.

An integer overflow flaw was found in the way the FreeType font engine
processed BDF font files. If a user loaded a carefully crafted font file
with a program linked against FreeType, it could cause the application to
crash or execute arbitrary code. While it is uncommon for a user to
explicitly load a font file, there are several application file formats
which contain embedded fonts that are parsed by FreeType. (CVE-2007-1351)

This flaw did not affect the version of FreeType shipped in Red Hat
Enterprise Linux 2.1.

Users of FreeType should upgrade to these updated packages, which contain
a backported patch to correct this issue.

Red Hat would like to thank iDefense for reporting this issue.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 234228 - CVE-2007-1351 BDF font integer overflow

CVEs

• CVE-2007-1351

References

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux for Power, big endian 4

SRPM
ppc
freetype-2.1.9-5.el4.ppc.rpm	SHA-256: 91c473d7c095c190c29bdb040d58aed31607a18d5fd28c73bed1e20c76638613
freetype-2.1.9-5.el4.ppc64.rpm	SHA-256: 5a56839c7bd5dfd5bfd2f4edd0b0403fe2b056bfbf7deeadc83ca6b19c10d850
freetype-demos-2.1.9-5.el4.ppc.rpm	SHA-256: ad75205b91094a16b667d1a9df2877a66c70b100d3a0551e845b3ea2c132ef15
freetype-devel-2.1.9-5.el4.ppc.rpm	SHA-256: 05dfde874938f300828902a9cc6dfab2edd220e7047a2acb78e7013afaffab4f
freetype-utils-2.1.9-5.el4.ppc.rpm	SHA-256: 0afa55c4af617a18d5689cde8b8141a9fba3b315c992fb0ffd9d1f432bf70b39