| Summary: | freetype2 several security issues fixed upstream in 2.5.4 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | cmrisolde, herman.viaene, olchal, ottoleipala1, sysadmin-bugs |
| Version: | 4 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/634231/ | ||
| Whiteboard: | has_procedure advisory mga4-32-ok MGA4-64-OK | ||
| Source RPM: | freetype2-2.5.0.1-3.2.mga4.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2015-02-20 23:06:24 CET
Details on these were supposed to be posted on oss-security, but I guess the guy forgot: http://openwall.com/lists/oss-security/2014/12/10/7 I had forgotten I had mentioned this in our last update: https://bugs.mageia.org/show_bug.cgi?id=14771#c6 until I was looking into this one. I'm not sure where RedHat finally ended up getting the details from. Maybe they dug them up themselves. Anyway, there's PoCs for some of these CVEs. Some of the upstream (GNU Savannah) bugs are closed, but here's links for the ones that are open, and Google bugs (which I got from the RedHat bugs) for the upstream ones that are closed. The Google bugs I linked, and the ones I indicated that don't have a PoC, don't have one. The others do. CVE-2014-9675: https://savannah.nongnu.org/bugs/?43535 CVE-2014-9673: (s43539) https://code.google.com/p/google-security-research/issues/detail?id=154 CVE-2014-9674: (s43538) https://code.google.com/p/google-security-research/issues/detail?id=153 CVE-2014-9672: (s43540) https://code.google.com/p/google-security-research/issues/detail?id=155 CVE-2014-9671: https://savannah.nongnu.org/bugs/?43547 CVE-2014-9670: https://savannah.nongnu.org/bugs/?43548 CVE-2014-9669: https://savannah.nongnu.org/bugs/?43588 (no PoC) CVE-2014-9667: https://savannah.nongnu.org/bugs/?43590 (no PoC) CVE-2014-9666: https://savannah.nongnu.org/bugs/?43591 (no PoC) CVE-2014-9664: https://savannah.nongnu.org/bugs/?43655 CVE-2014-9663: https://savannah.nongnu.org/bugs/?43656 CVE-2014-9662: https://savannah.nongnu.org/bugs/?43658 CVE-2014-9661: https://savannah.nongnu.org/bugs/?43659 CVE-2014-9660: https://savannah.nongnu.org/bugs/?43660 CVE-2014-9658: https://savannah.nongnu.org/bugs/?43672 CVE-2014-9657: https://savannah.nongnu.org/bugs/?43679 CVE-2014-9656: https://savannah.nongnu.org/bugs/?43680 Also note that two of the CVEs are rated as high severity, so we could play with the CVEs, but checking for obvious regressions and getting the update out are more important. I used the same patches Fedora used for the Fedora 20 update. I can confirm that things look fine in applications that use libfreetype6, like Firefox, LibreOffice, xpdf, and okular. I'll test a few applications on my 64-bit machine. Carolyn CC:
(none) =>
cmrisolde Actually, does this only affect 32-bit packages and not the lib64freetype... ones? Carolyn Update is only to 32bit freetype package not 64bit. CC:
(none) =>
ozkyster Both arch's should have been updated. There are also core updates testing and tainted updates testing versions to test. General tests: https://bugs.mageia.org/show_bug.cgi?id=8497#c7 https://bugs.mageia.org/show_bug.cgi?id=14771 Whiteboard:
(none) =>
has_procedure Yes sorry need to correct that was just mirror didn't get synced yet 64bit. OK, I'll try amd have a look tomorrow. On my 64-bit laptop with the Core updates, installation proceeded smoothly, no regressions noticed in Firefox, LibreOffice or Okular. Running "ftbench /usr/share/fonts/75dpi/helvBO08-ISO8859-15.pcf.gz" worked fine before and after update. Will have a look at the Tainted ones shortly. On my 64-bit laptop with the Core updates, installation proceeded smoothly, no regressions noticed in Firefox, LibreOffice or Okular. Running "ftbench /usr/share/fonts/75dpi/helvBO08-ISO8859-15.pcf.gz" worked fine before and after update. Same again with the Tainted packages, no problems noticed. Testing on Mageia4x64, real hardware From current packages : --------------------- lib64freetype6-2.5.0.1-3.2.mga4 core and tainted $ ftbench asan_stack-oob_703c16_2728_cov_367593004_aspartam.otf $ ftbench asan_stack-oob_703c16_5479_cov_4290077649_elsewher.otf $ ftbench asan_stack-oob_703c16_3507_cov_3211953920_ccapshad.otf Updated to testing packages : --------------------------- - freetype2-demos-2.5.0.1-3.3.mga4.x86_64 - lib64freetype6-2.5.0.1-3.3.mga4.x86_64 - lib64freetype6-devel-2.5.0.1-3.3.mga4.x86_64 - lib64freetype6-static-devel-2.5.0.1-3.3.mga4.x86_64 Ran same ftbenchs = OK $ ftgamma asan_stack-oob_703c16_3507_cov_3211953920_ccapshad.otf =OK $ ftdump asan_stack-oob_703c16_3507_cov_3211953920_ccapshad.otf =OK $ ftdiff asan_stack-oob_703c16_3507_cov_3211953920_ccapshad.otf =OK updated to same version 2.5.0.1-3.3.mga4. in tainted Ran same fttests= OK CC:
(none) =>
olchal MGA4-32 on Acer D620 Xfce Installed from Core Updatzq, no installation issues. $ ftbench asan_stack-oob_703c16_2728_cov_367593004_aspartam.otf couldn't load font resource Only otf files on my system: $ locate *.otf /usr/share/fonts/abattis-cantarell-fonts/Cantarell-Bold.otf /usr/share/fonts/abattis-cantarell-fonts/Cantarell-Regular.otf So?????? CC:
(none) =>
herman.viaene (In reply to Herman Viaene from comment #12) > MGA4-32 on Acer D620 Xfce > Installed from Core Updatzq, no installation issues. > $ ftbench asan_stack-oob_703c16_2728_cov_367593004_aspartam.otf > couldn't load font resource > Only otf files on my system: > $ locate *.otf > /usr/share/fonts/abattis-cantarell-fonts/Cantarell-Bold.otf > /usr/share/fonts/abattis-cantarell-fonts/Cantarell-Regular.otf > So?????? Hi Herman, In comment 11, I used open type fonts downloaded in the FreeType Project site but you can use any fonts located in you /usr/share/fonts folder I think. Testing complete mga4 32, core and tainted. ftbench and general use, many applications use this library. urpmq --whatrequires libfreetype6 Whiteboard:
has_procedure MGA4-64-OK =>
has_procedure mga4-32-ok MGA4-64-OK Validating. Advisory uploaded, added the tainted srpm. Please push to 4 updates Thanks Keywords:
(none) =>
validated_update An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2015-0083.html Status:
NEW =>
RESOLVED |