Bug 916868 (CVE-2014-9668) - VUL-0: CVE-2014-9668: freetype2: integer overflow and heap-based buffer overflow in the woff_open_font function in sfnt/sfobjs.c
Summary: VUL-0: CVE-2014-9668: freetype2: integer overflow and heap-based buffer overf...
Status: RESOLVED FIXED
Alias: CVE-2014-9668
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Deadline: 2015-02-25
Assignee: Vladimir Nadvornik
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/113644/
Whiteboard: CVSSv2:NVD:CVE-2014-9668:7.5:(AV:N/AC...
Keywords:
Depends on:
Blocks:
 
Reported: 2015-02-09 10:57 UTC by Johannes Segitz
Modified: 2019-05-22 01:02 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2015-02-09 10:57:10 UTC 
CVE-2014-9668

The woff_open_font function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds
with offset+length calculations without restricting length values, which allows
remote attackers to cause a denial of service (integer overflow and heap-based
buffer overflow) or possibly have unspecified other impact via a crafted Web
Open Font Format (WOFF) file.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9668
http://code.google.com/p/google-security-research/issues/detail?id=164
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=f46add13895337ece929b18bb8f036431b3fb538
Comment 1 Swamp Workflow Management 2015-02-09 23:03:13 UTC 
bugbot adjusting priority
Comment 2 Swamp Workflow Management 2015-02-11 08:47:00 UTC 
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2015-02-25.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/60646
Comment 3 Vladimir Nadvornik 2015-02-19 17:14:15 UTC 
SLE11 is not affected, I have not found the code in freetype2-2.3.7 and the poc file does not crash.
Comment 4 Bernhard Wiedemann 2015-02-20 15:00:51 UTC 
This is an autogenerated message for OBS integration:
This bug (916868) was mentioned in
https://build.opensuse.org/request/show/286989 13.2 / freetype2
Comment 6 Swamp Workflow Management 2015-03-10 14:08:00 UTC 
SUSE-SU-2015:0455-1: An update that fixes 21 vulnerabilities is now available.

Category: security (moderate)
Bug References: 916847,916856,916857,916858,916859,916860,916861,916862,916863,916864,916865,916867,916868,916870,916871,916872,916873,916874,916879,916881
CVE References: CVE-2014-2240,CVE-2014-9656,CVE-2014-9657,CVE-2014-9658,CVE-2014-9659,CVE-2014-9660,CVE-2014-9661,CVE-2014-9662,CVE-2014-9663,CVE-2014-9664,CVE-2014-9665,CVE-2014-9666,CVE-2014-9667,CVE-2014-9668,CVE-2014-9669,CVE-2014-9670,CVE-2014-9671,CVE-2014-9672,CVE-2014-9673,CVE-2014-9674,CVE-2014-9675
Sources used:
SUSE Linux Enterprise Software Development Kit 12 (src):    freetype2-2.5.3-5.1
SUSE Linux Enterprise Server 12 (src):    freetype2-2.5.3-5.1
SUSE Linux Enterprise Desktop 12 (src):    freetype2-2.5.3-5.1
Comment 7 Bernhard Wiedemann 2015-03-20 16:00:50 UTC 
This is an autogenerated message for OBS integration:
This bug (916868) was mentioned in
https://build.opensuse.org/request/show/292048 13.2 / freetype2
Comment 8 Marcus Meissner 2015-03-30 14:43:12 UTC 
released
Comment 9 Swamp Workflow Management 2015-03-30 15:07:16 UTC 
openSUSE-SU-2015:0627-1: An update that fixes 20 vulnerabilities is now available.

Category: security (moderate)
Bug References: 916847,916856,916857,916858,916859,916860,916861,916862,916863,916864,916865,916867,916868,916870,916871,916872,916873,916874,916879,916881
CVE References: CVE-2014-9656,CVE-2014-9657,CVE-2014-9658,CVE-2014-9659,CVE-2014-9660,CVE-2014-9661,CVE-2014-9662,CVE-2014-9663,CVE-2014-9664,CVE-2014-9665,CVE-2014-9666,CVE-2014-9667,CVE-2014-9668,CVE-2014-9669,CVE-2014-9670,CVE-2014-9671,CVE-2014-9672,CVE-2014-9673,CVE-2014-9674,CVE-2014-9675
Sources used:
openSUSE 13.2 (src):    freetype2-2.5.3-2.4.1, ft2demos-2.5.3-2.4.1
openSUSE 13.1 (src):    freetype2-2.5.0.1-2.4.1, ft2demos-2.5.0-2.4.1