[Precise] FreeType is vulnerable to CVE-2012-1126 through CVE-2012-1144

I've tested this debdiff using the QA Regression Testing framework and the reproducers attached to the upstream bugs.

Please note that there are regressions wrt ghostscript with freetype 2.4.9; these may be intertwined with the security patches, I haven't looked yet.

  https://savannah.nongnu.org/bugs/index.php?35847
  https://savannah.nongnu.org/bugs/index.php?35833

On 2012-03-23 17:52:04, Steve Langasek wrote:
> Please note that there are regressions wrt ghostscript with freetype
> 2.4.9; these may be intertwined with the security patches, I haven't
> looked yet.

They are intertwined with the security patches, but the attached debdiff
already accounts for them.

> https://savannah.nongnu.org/bugs/index.php?35847
> https://savannah.nongnu.org/bugs/index.php?35833

Fixes for both of these bugs are included, along with the original
CVE-2012-1132 fix, in CVE-2012-1132.patch

On Fri, Mar 23, 2012 at 06:14:55PM -0000, Tyler Hicks wrote:
> On 2012-03-23 17:52:04, Steve Langasek wrote:
> > Please note that there are regressions wrt ghostscript with freetype
> > 2.4.9; these may be intertwined with the security patches, I haven't
> > looked yet.

> They are intertwined with the security patches, but the attached debdiff
> already accounts for them.

> > https://savannah.nongnu.org/bugs/index.php?35847
> > https://savannah.nongnu.org/bugs/index.php?35833

> Fixes for both of these bugs are included, along with the original
> CVE-2012-1132 fix, in CVE-2012-1132.patch

Great, thanks!

--
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
Ubuntu Developer http://www.debian.org/
<email address hidden> <email address hidden>

I tested this with QRT and all tests pass. I also booted into a precise VM and examined various menus, used libreoffice, used evince, and performed printing operations. Uploading to precise. This is not critical for beta-2, but it is fine if it ends up there.

Unsubscribing ubuntu-security-sponsors now that it is uploaded.

This bug was fixed in the package freetype - 2.4.8-1ubuntu1

---------------
freetype (2.4.8-1ubuntu1) precise; urgency=low

  * SECURITY UPDATE: Denial of service via crafted BDF font (LP: #963283)
    - debian/patches-freetype/CVE-2012-1126.patch: Perform better input
      sanitization when parsing properties. Based on upstream patch.
    - CVE-2012-1126
  * SECURITY UPDATE: Denial of service via crafted BDF font
    - debian/patches-freetype/CVE-2012-1127.patch: Perform better input
      sanitization when parsing glyphs. Based on upstream patch.
    - CVE-2012-1127
  * SECURITY UPDATE: Denial of service via crafted TrueType font
    - debian/patches-freetype/CVE-2012-1128.patch: Improve loop logic to avoid
      NULL pointer dereference. Based on upstream patch.
    - CVE-2012-1128
  * SECURITY UPDATE: Denial of service via crafted Type42 font
    - debian/patches-freetype/CVE-2012-1129.patch: Perform better input
      sanitization when parsing SFNT strings. Based on upstream patch.
    - CVE-2012-1129
  * SECURITY UPDATE: Denial of service via crafted PCF font
    - debian/patches-freetype/CVE-2012-1130.patch: Allocate enough memory to
      properly NULL-terminate parsed properties strings. Based on upstream
      patch.
    - CVE-2012-1130
  * SECURITY UPDATE: Denial of service via crafted TrueType font
    - debian/patches-freetype/CVE-2012-1131.patch: Use appropriate data type to
      prevent integer truncation on 64 bit systems when rendering fonts. Based
      on upstream patch.
    - CVE-2012-1131
  * SECURITY UPDATE: Denial of service via crafted Type1 font
    - debian/patches-freetype/CVE-2012-1132.patch: Ensure strings are of
      appropriate length when loading Type1 fonts. Based on upstream patch.
    - CVE-2012-1132
  * SECURITY UPDATE: Denial of service and arbitrary code execution via
    crafted BDF font
    - debian/patches-freetype/CVE-2012-1133.patch: Limit range of negative
      glyph encoding values to prevent invalid array indexes. Based on
      upstream patch.
    - CVE-2012-1133
  * SECURITY UPDATE: Denial of service and arbitrary code execution via
    crafted Type1 font
    - debian/patches-freetype/CVE-2012-1134.patch: Enforce a minimum Type1
      private dictionary size to prevent writing past array bounds. Based on
      upstream patch.
    - CVE-2012-1134
  * SECURITY UPDATE: Denial of service via crafted TrueType font
    - debian/patches-freetype/CVE-2012-1135.patch: Perform proper bounds
      checks when interpreting TrueType bytecode. Based on upstream patch.
    - CVE-2012-1135
  * SECURITY UPDATE: Denial of service and arbitrary code execution via
    crafted BDF font
    - debian/patches-freetype/CVE-2012-1136.patch: Ensure encoding field is
      defined when parsing glyphs. Based on upstream patch.
    - CVE-2012-1136
  * SECURITY UPDATE: Denial of service via crafted BDF font
    - debian/patches-freetype/CVE-2012-1137.patch: Allocate sufficient number
      of array elements to prevent reading past array bounds. Based on
      upstream patch.
    - CVE-2012-1137
  * SECURITY UPDATE: Denial of service via crafted TrueType font
    - debian/patches-freetype/CVE-2012-1138.patch: Correct typo...