User: Password:
|
|
Subscribe / Log in / New account

Gentoo alert 201402-16 (freetype)

From:  Mikle Kolyada <zlogene@gentoo.org>
To:  gentoo-announce@gentoo.org
Subject:  [gentoo-announce] [ GLSA 201402-16 ] FreeType: Multiple vulnerabilities
Date:  Tue, 11 Feb 2014 23:23:57 +0400
Message-ID:  <52FA78CD.8040806@gentoo.org>

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201402-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: FreeType: Multiple vulnerabilities Date: February 11, 2014 Bugs: #448550 ID: 201402-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in FreeType, allowing context-dependent attackers to possibly execute arbitrary code or cause Denial of Service. Background ========== FreeType is a high-quality and portable font engine. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-libs/freetype < 2.4.11 >= 2.4.11 Description =========== Multiple vulnerabilities have been discovered in FreeType. Please review the CVE identifiers referenced below for details. Impact ====== A context-dependent attacker could entice a user to open a specially crafted font, possibly resulting in execution of arbitrary code with the privileges of the user running the application, or a Denial of Service condition. Workaround ========== There is no known workaround at this time. Resolution ========== All Freetype users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/freetype-2.4.11" Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying these packages. References ========== [ 1 ] CVE-2012-5668 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5668 [ 2 ] CVE-2012-5669 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5669 [ 3 ] CVE-2012-5670 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5670 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201402-16.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2014 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5


(Log in to post comments)


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds