Synopsis

Important: freetype security update

Type/Severity

Security Advisory: Important

Topic

Updated freetype packages that fix various security issues are now
available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

FreeType is a free, high-quality, portable font engine that can open and
manage font files. It also loads, hints, and renders individual glyphs
efficiently. These packages provide the FreeType 2 font engine.

Tavis Ormandy of the Google Security Team discovered several integer
overflow flaws in the FreeType 2 font engine. If a user loaded a
carefully-crafted font file with an application linked against FreeType 2,
it could cause the application to crash or, possibly, execute arbitrary
code with the privileges of the user running the application.
(CVE-2009-0946)

Users are advised to upgrade to these updated packages, which contain a
backported patch to correct these issues. The X server must be restarted
(log out, then log back in) for this update to take effect.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server - Extended Update Support 5.3 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.3 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.3 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.3 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386
• Red Hat Enterprise Linux Server - AUS 5.3 x86_64
• Red Hat Enterprise Linux Server - AUS 5.3 ia64
• Red Hat Enterprise Linux Server - AUS 5.3 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.3 ppc

Fixes

• BZ - 491384 - CVE-2009-0946 freetype: multiple integer overflows

CVEs

• CVE-2009-0946

References

• http://www.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux Server 5

SRPM
freetype-2.2.1-21.el5_3.src.rpm	SHA-256: 96e58a340fcb01c7d122b15033687c6701ffbd55b44587c761e2ddeb7654fcad
x86_64
freetype-2.2.1-21.el5_3.i386.rpm	SHA-256: 2bc0caaa9cfd65d607349898ac15c1e8bdd99907ff6008a92004ead1cbab887b
freetype-2.2.1-21.el5_3.x86_64.rpm	SHA-256: 42dbf1cb19a6bd1eb55c1de6ff8a2a523a798b6b0c62144a6d3b09a5aa52f29c
freetype-demos-2.2.1-21.el5_3.x86_64.rpm	SHA-256: 7acff912303c6f9fbb3026a900ad80e01887a4c58100aca251dc18fea4ac3573
freetype-devel-2.2.1-21.el5_3.i386.rpm	SHA-256: c32a4d32ba6c183bb58a14ca556ed9ea2fd812255429d20f0c3152a2c25703f4
freetype-devel-2.2.1-21.el5_3.x86_64.rpm	SHA-256: 7b042546e25ea96762fda7cee16a9bf65455f338cf647510d7887f6a4d30e7c9
ia64
freetype-2.2.1-21.el5_3.i386.rpm	SHA-256: 2bc0caaa9cfd65d607349898ac15c1e8bdd99907ff6008a92004ead1cbab887b
freetype-2.2.1-21.el5_3.ia64.rpm	SHA-256: 46c2820cb65173d8cd06ec4bb8b6d124024a30756b51d50efa62b5007496d63f
freetype-demos-2.2.1-21.el5_3.ia64.rpm	SHA-256: 07303600275f905df4c4ed94eddfa643b66c5472878f909ded17ec3caa8c94ec
freetype-devel-2.2.1-21.el5_3.ia64.rpm	SHA-256: 9e78104008b9a60bd25c265f95c5830fa6030744bd3b86ee417ddd458db8291b
i386
freetype-2.2.1-21.el5_3.i386.rpm	SHA-256: 2bc0caaa9cfd65d607349898ac15c1e8bdd99907ff6008a92004ead1cbab887b
freetype-demos-2.2.1-21.el5_3.i386.rpm	SHA-256: 52f051568ded7254c010ee09ce52876e17d198fab5cb43f777ed8abe9f8c0cac
freetype-devel-2.2.1-21.el5_3.i386.rpm	SHA-256: c32a4d32ba6c183bb58a14ca556ed9ea2fd812255429d20f0c3152a2c25703f4

Red Hat Enterprise Linux Workstation 5

SRPM
freetype-2.2.1-21.el5_3.src.rpm	SHA-256: 96e58a340fcb01c7d122b15033687c6701ffbd55b44587c761e2ddeb7654fcad
x86_64
freetype-2.2.1-21.el5_3.i386.rpm	SHA-256: 2bc0caaa9cfd65d607349898ac15c1e8bdd99907ff6008a92004ead1cbab887b
freetype-2.2.1-21.el5_3.x86_64.rpm	SHA-256: 42dbf1cb19a6bd1eb55c1de6ff8a2a523a798b6b0c62144a6d3b09a5aa52f29c
freetype-demos-2.2.1-21.el5_3.x86_64.rpm	SHA-256: 7acff912303c6f9fbb3026a900ad80e01887a4c58100aca251dc18fea4ac3573
freetype-devel-2.2.1-21.el5_3.i386.rpm	SHA-256: c32a4d32ba6c183bb58a14ca556ed9ea2fd812255429d20f0c3152a2c25703f4
freetype-devel-2.2.1-21.el5_3.x86_64.rpm	SHA-256: 7b042546e25ea96762fda7cee16a9bf65455f338cf647510d7887f6a4d30e7c9
i386
freetype-2.2.1-21.el5_3.i386.rpm	SHA-256: 2bc0caaa9cfd65d607349898ac15c1e8bdd99907ff6008a92004ead1cbab887b
freetype-demos-2.2.1-21.el5_3.i386.rpm	SHA-256: 52f051568ded7254c010ee09ce52876e17d198fab5cb43f777ed8abe9f8c0cac
freetype-devel-2.2.1-21.el5_3.i386.rpm	SHA-256: c32a4d32ba6c183bb58a14ca556ed9ea2fd812255429d20f0c3152a2c25703f4

Red Hat Enterprise Linux Desktop 5

SRPM
freetype-2.2.1-21.el5_3.src.rpm	SHA-256: 96e58a340fcb01c7d122b15033687c6701ffbd55b44587c761e2ddeb7654fcad
x86_64
freetype-2.2.1-21.el5_3.i386.rpm	SHA-256: 2bc0caaa9cfd65d607349898ac15c1e8bdd99907ff6008a92004ead1cbab887b
freetype-2.2.1-21.el5_3.x86_64.rpm	SHA-256: 42dbf1cb19a6bd1eb55c1de6ff8a2a523a798b6b0c62144a6d3b09a5aa52f29c
i386
freetype-2.2.1-21.el5_3.i386.rpm	SHA-256: 2bc0caaa9cfd65d607349898ac15c1e8bdd99907ff6008a92004ead1cbab887b

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
freetype-2.2.1-21.el5_3.src.rpm	SHA-256: 96e58a340fcb01c7d122b15033687c6701ffbd55b44587c761e2ddeb7654fcad
s390x
freetype-2.2.1-21.el5_3.s390.rpm	SHA-256: 56f20f2fc4cf6047f2c04cf9b9a47e03fafc000545977d1be6503bff5a5727b5
freetype-2.2.1-21.el5_3.s390x.rpm	SHA-256: bc664e3214531f754874668f842473d862228093254eca041b35a663935c43b5
freetype-demos-2.2.1-21.el5_3.s390x.rpm	SHA-256: 5f694e0e57764948b47f6586abcfa922be94d89360c74b14c6ffa4ec1862200b
freetype-devel-2.2.1-21.el5_3.s390.rpm	SHA-256: a758576d2527b4a74ee45fe5e6cf8babea4ae981121361884ca29f27aa1654cb
freetype-devel-2.2.1-21.el5_3.s390x.rpm	SHA-256: 6ca72fa6dec9f3733be8532696abf88ec4cdb77ce29ba5334aa6b30464e82225

Red Hat Enterprise Linux for Power, big endian 5

SRPM
freetype-2.2.1-21.el5_3.src.rpm	SHA-256: 96e58a340fcb01c7d122b15033687c6701ffbd55b44587c761e2ddeb7654fcad
ppc
freetype-2.2.1-21.el5_3.ppc.rpm	SHA-256: 04d13fa920fe00997c7bbcd892083e694d08fa1952534d94ec6eb16fa51820ea
freetype-2.2.1-21.el5_3.ppc64.rpm	SHA-256: ab356228b63f18d87fe57131967435186f29a0fb1d2553e60b26d029c0ef563f
freetype-demos-2.2.1-21.el5_3.ppc.rpm	SHA-256: 7ca779d74916c32bef7f8e3ebccbb22af4dc16cb4992fb8bd769920f5bf6cbe3
freetype-devel-2.2.1-21.el5_3.ppc.rpm	SHA-256: 7e92f30c6f3821c20d2cc59868b87eb1729d409774a9237f7ce12b040a5f07fd
freetype-devel-2.2.1-21.el5_3.ppc64.rpm	SHA-256: 4f4af51b26c85f8a06c544dc661aee8830037b4acdad9756e09a2901b7839370

Red Hat Enterprise Linux Server from RHUI 5

SRPM
freetype-2.2.1-21.el5_3.src.rpm	SHA-256: 96e58a340fcb01c7d122b15033687c6701ffbd55b44587c761e2ddeb7654fcad
x86_64
freetype-2.2.1-21.el5_3.i386.rpm	SHA-256: 2bc0caaa9cfd65d607349898ac15c1e8bdd99907ff6008a92004ead1cbab887b
freetype-2.2.1-21.el5_3.x86_64.rpm	SHA-256: 42dbf1cb19a6bd1eb55c1de6ff8a2a523a798b6b0c62144a6d3b09a5aa52f29c
freetype-demos-2.2.1-21.el5_3.x86_64.rpm	SHA-256: 7acff912303c6f9fbb3026a900ad80e01887a4c58100aca251dc18fea4ac3573
freetype-devel-2.2.1-21.el5_3.i386.rpm	SHA-256: c32a4d32ba6c183bb58a14ca556ed9ea2fd812255429d20f0c3152a2c25703f4
freetype-devel-2.2.1-21.el5_3.x86_64.rpm	SHA-256: 7b042546e25ea96762fda7cee16a9bf65455f338cf647510d7887f6a4d30e7c9
i386
freetype-2.2.1-21.el5_3.i386.rpm	SHA-256: 2bc0caaa9cfd65d607349898ac15c1e8bdd99907ff6008a92004ead1cbab887b
freetype-demos-2.2.1-21.el5_3.i386.rpm	SHA-256: 52f051568ded7254c010ee09ce52876e17d198fab5cb43f777ed8abe9f8c0cac
freetype-devel-2.2.1-21.el5_3.i386.rpm	SHA-256: c32a4d32ba6c183bb58a14ca556ed9ea2fd812255429d20f0c3152a2c25703f4