CVE-2008-1807 - FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via an invalid "n

CVE-2008-1807

Summary

FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via an invalid "number of axes" field in a Printer Font Binary (PFB) file, which triggers a free of arbitrary memory locations, leading to memory corruption.

References

Vulnerable Configurations

cpe:2.3:a:freetype:freetype:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.3:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.3:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.4:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.4:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.5:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.5:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 11-10-2018 - 20:36)
Impact:
Exploitability:

CWE

CWE-189

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

oval via4

accepted

2013-04-29T04:22:00.010-04:00

class

vulnerability

contributors

name Aharon Chernin
organization SCAP.com, LLC
name Dragos Prisaca
organization G2, Inc.

definition_extensions

comment The operating system installed on the system is Red Hat Enterprise Linux 3
oval oval:org.mitre.oval:def:11782
comment CentOS Linux 3.x
oval oval:org.mitre.oval:def:16651
comment The operating system installed on the system is Red Hat Enterprise Linux 4
oval oval:org.mitre.oval:def:11831
comment CentOS Linux 4.x
oval oval:org.mitre.oval:def:16636
comment Oracle Linux 4.x
oval oval:org.mitre.oval:def:15990
comment The operating system installed on the system is Red Hat Enterprise Linux 5
oval oval:org.mitre.oval:def:11414
comment The operating system installed on the system is CentOS Linux 5.x
oval oval:org.mitre.oval:def:15802
comment Oracle Linux 5.x
oval oval:org.mitre.oval:def:15459

description

family

unix

oval:org.mitre.oval:def:9767

status

accepted

submitted

2010-07-09T03:56:16-04:00

title

version

redhat via4

advisories

rhsa
id RHSA-2008:0556
rhsa
id RHSA-2008:0558

rpms

freetype-0:2.1.4-10.el3
freetype-0:2.1.9-8.el4.6
freetype-0:2.2.1-20.el5_2
freetype-debuginfo-0:2.1.4-10.el3
freetype-debuginfo-0:2.1.9-8.el4.6
freetype-debuginfo-0:2.2.1-20.el5_2
freetype-demos-0:2.1.9-8.el4.6
freetype-demos-0:2.2.1-20.el5_2
freetype-devel-0:2.1.4-10.el3
freetype-devel-0:2.1.9-8.el4.6
freetype-devel-0:2.2.1-20.el5_2
freetype-utils-0:2.1.9-8.el4.6
freetype-0:2.0.3-15.el21
freetype-devel-0:2.0.3-15.el21
freetype-utils-0:2.0.3-15.el21

refmap via4

apple	APPLE-SA-2008-09-09 APPLE-SA-2008-09-12 APPLE-SA-2009-02-12
bid	29641
bugtraq	20080814 rPSA-2008-0255-1 freetype 20080830 VMSA-2008-0014 Updates to VMware Workstation, VMware Player, VMware ACE, VMware Server, VMware ESX address information disclosure, privilege escalation and other security issues.
confirm	http://support.apple.com/kb/HT3026 http://support.apple.com/kb/HT3129 http://support.apple.com/kb/HT3438 http://support.avaya.com/elmodocs2/security/ASA-2008-318.htm http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0255 http://www.vmware.com/security/advisories/VMSA-2008-0014.html http://www.vmware.com/support/player/doc/releasenotes_player.html http://www.vmware.com/support/player2/doc/releasenotes_player2.html http://www.vmware.com/support/server/doc/releasenotes_server.html http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html https://issues.rpath.com/browse/RPL-2608
fedora	FEDORA-2008-5425 FEDORA-2008-5430
fulldisc	20080830 VMSA-2008-0014 Updates to VMware Workstation, VMware Player, VMware ACE, VMware Server, VMware ESX address information disclosure, privilege escalation and other security issues.
gentoo	GLSA-200806-10 GLSA-201209-25
idefense	20080610 Multiple Vendor FreeType2 PFB Memory Corruption Vulnerability
mandriva	MDVSA-2008:121
misc	http://sourceforge.net/project/shownotes.php?group_id=3157&release_id=605780
sectrack	1020239
secunia	30600 30721 30740 30766 30819 30821 30967 31479 31577 31707 31709 31711 31712 31823 31856 31900 33937
sunalert	239006
suse	SUSE-SR:2008:014
ubuntu	USN-643-1
vupen	ADV-2008-1794 ADV-2008-1876 ADV-2008-2423 ADV-2008-2466 ADV-2008-2525 ADV-2008-2558

Last major update

11-10-2018 - 20:36

Published

16-06-2008 - 19:41

Last modified

11-10-2018 - 20:36