lp:ubuntu/maverick-updates/freetype

Created by James Westby on 2010-11-04 and last modified on 2012-03-21
Get this branch:
bzr branch lp:ubuntu/maverick-updates/freetype
Members of Ubuntu branches can upload to this branch. Log in for directions.

Branch merges

Related bugs

Related blueprints

Branch information

Owner:
Ubuntu branches
Review team:
Ubuntu Development Team
Status:
Mature

Recent revisions

35. By Tyler Hicks on 2012-03-21

* SECURITY UPDATE: Denial of service via crafted BDF font
  - debian/patches-freetype/CVE-2012-1126.patch: Perform better input
    sanitization when parsing properties. Based on upstream patch.
  - CVE-2012-1126
* SECURITY UPDATE: Denial of service via crafted BDF font
  - debian/patches-freetype/CVE-2012-1127.patch: Perform better input
    sanitization when parsing glyphs. Based on upstream patch.
  - CVE-2012-1127
* SECURITY UPDATE: Denial of service via crafted TrueType font
  - debian/patches-freetype/CVE-2012-1128.patch: Improve loop logic to avoid
    NULL pointer dereference. Based on upstream patch.
  - CVE-2012-1128
* SECURITY UPDATE: Denial of service via crafted Type42 font
  - debian/patches-freetype/CVE-2012-1129.patch: Perform better input
    sanitization when parsing SFNT strings. Based on upstream patch.
  - CVE-2012-1129
* SECURITY UPDATE: Denial of service via crafted PCF font
  - debian/patches-freetype/CVE-2012-1130.patch: Allocate enough memory to
    properly NULL-terminate parsed properties strings. Based on upstream
    patch.
  - CVE-2012-1130
* SECURITY UPDATE: Denial of service via crafted TrueType font
  - debian/patches-freetype/CVE-2012-1131.patch: Use appropriate data type to
    prevent integer truncation on 64 bit systems when rendering fonts. Based
    on upstream patch.
  - CVE-2012-1131
* SECURITY UPDATE: Denial of service via crafted Type1 font
  - debian/patches-freetype/CVE-2012-1132.patch: Ensure strings are of
    appropriate length when loading Type1 fonts. Based on upstream patch.
  - CVE-2012-1132
* SECURITY UPDATE: Denial of service and arbitrary code execution via
  crafted BDF font
  - debian/patches-freetype/CVE-2012-1133.patch: Limit range of negative
    glyph encoding values to prevent invalid array indexes. Based on
    upstream patch.
  - CVE-2012-1133
* SECURITY UPDATE: Denial of service and arbitrary code execution via
  crafted Type1 font
  - debian/patches-freetype/CVE-2012-1134.patch: Enforce a minimum Type1
    private dictionary size to prevent writing past array bounds. Based on
    upstream patch.
  - CVE-2012-1134
* SECURITY UPDATE: Denial of service via crafted TrueType font
  - debian/patches-freetype/CVE-2012-1135.patch: Perform proper bounds
    checks when interpreting TrueType bytecode. Based on upstream patch.
  - CVE-2012-1135
* SECURITY UPDATE: Denial of service and arbitrary code execution via
  crafted BDF font
  - debian/patches-freetype/CVE-2012-1136.patch: Ensure encoding field is
    defined when parsing glyphs. Based on upstream patch.
  - CVE-2012-1136
* SECURITY UPDATE: Denial of service via crafted BDF font
  - debian/patches-freetype/CVE-2012-1137.patch: Allocate sufficient number
    of array elements to prevent reading past array bounds. Based on
    upstream patch.
  - CVE-2012-1137
* SECURITY UPDATE: Denial of service via crafted TrueType font
  - debian/patches-freetype/CVE-2012-1138.patch: Correct typo resulting in
    invalid read from wrong memory location. Based on upstream patch.
  - CVE-2012-1138
* SECURITY UPDATE: Denial of service via crafted BDF font
  - debian/patches-freetype/CVE-2012-1139.patch: Check array index values to
    prevent reading invalid memory. Based on upstream patch.
  - CVE-2012-1139
* SECURITY UPDATE: Denial of service via crafted PostScript font
  - debian/patches-freetype/CVE-2012-1140.patch: Fix off-by-one error in
    boundary checks. Based on upstream patch.
  - CVE-2012-1140
* SECURITY UPDATE: Denial of service via crafted BDF font
  - debian/patches-freetype/CVE-2012-1141.patch: Initialize field elements
    to prevent invalid read. Based on upstream patch.
  - CVE-2012-1141
* SECURITY UPDATE: Denial of service via crafted Windows FNT/FON font
  - debian/patches-freetype/CVE-2012-1142.patch: Perform input sanitization
    on first and last character code fields. Based on upstream patch.
  - CVE-2012-1142
* SECURITY UPDATE: Denial of service via crafted font
  - debian/patches-freetype/CVE-2012-1143.patch: Protect against divide by
    zero when dealing with 32 bit types. Based on upstream patch.
  - CVE-2012-1143
* SECURITY UPDATE: Denial of service and arbitrary code execution via
  crafted TrueType font
  - debian/patches-freetype/CVE-2012-1144.patch: Perform input sanitization
    on the first glyph outline point value. Based on upstream patch.
  - CVE-2012-1144

34. By Tyler Hicks on 2011-11-17

* SECURITY UPDATE: Arbitrary code execution via crafted Type 1 font
  - debian/patches-freetype/CVE-2011-3256.patch: Sanitize Type 1 font inputs
    in src/base/ftbitmap.c, src/psaux/t1decode.c, src/raster/ftrend1.c, and
    src/truetype/ttgxvar.c. Based on upstream patch.
  - CVE-2011-3256
* SECURITY UPDATE: Arbitrary code execution via crafted CID-keyed PS font
  - debian/patches-freetype/CVE-2011-3439.patch: Sanitize CID-keyed
    PostScript font inputs in src/cid/cidload.c. Based on upstream patch.
  - CVE-2011-3439

33. By Marc Deslauriers on 2011-07-21

* SECURITY UPDATE: arbitrary code execution via crafted Type 1 font
  - debian/patches-freetype/CVE-2011-0226.patch: check for proper
    signedness in src/psaux/t1decode.c.
  - CVE-2011-0226

32. By Marc Deslauriers on 2010-11-02

* SECURITY UPDATE: denial of service and possible code execution via
  improper error handling of SHZ bytecode instruction
  - debian/patches/CVE-2010-3814.patch: add bounds check to
    src/truetype/ttinterp.c.
  - CVE-2010-3814
* SECURITY UPDATE: denial of service and possible code execution via
  TrueType GX font
  - debian/patches/CVE-2010-3855.patch: add bounds checks to
    src/truetype/ttgxvar.c.
  - CVE-2010-3855

31. By Steve Langasek on 2010-08-28

debian/patches-ft2demos/f2tdemos-grkey.patch: update to fix another
problem when building under gcc-4.5 that was overlooked in the previous
version of the patch. LP: #624740.

30. By Steve Langasek on 2010-08-10

* New upstream release
  - High urgency upload for RC security bugfix.
  - Corrects a stack overflow in the interpreter for CFF fonts
    (CVE-2010-1797). Closes: #592399.
  - drop debian/patches-freetype/opentype-missing-glyphs, included
    upstream.
* Update libfreetype6.symbols for two new functions.

29. By Steve Langasek on 2010-07-16

* debian/patches-freetype/opentype-missing-glyphs: fix from upstream for
  glyphs from OpenType fonts failing to render. Closes: #589256,
  LP: #605858.
* Medium-urgency upload to fix important regression.

28. By Steve Langasek on 2010-07-13

* New upstream release (closes: #572576).
  - fixes CVE-2010-2497, CVE-2010-2498, CVE-2010-2499, CVE-2010-2500,
    CVE-2010-2519, and CVE-2010-2520
  - high-urgency upload for security bugfixes.
  - drop debian/patches-freetype/freetype-bytecode-interpreter.patch and
    debian/patches-freetype/enable-full-bytecode-interpreter - the
    bytecode interpreter is now enabled by default upstream at last!
  - drop debian/patches-freetype/freetype-bdflib-large-encodings.patch and
    debian/patches-freetype/uninitialized-vars.patch, applied upstream.
  - drop debian/patches-freetype/331-hmtx-no-shorts.diff, implemented
    differently upstream.
  - new symbol FT_Library_SetLcdFilterWeights added to the symbols table,
    bump the shlibs.
  - fixes problem with outlines for some OpenType fonts. Closes; #583868.
* Add a debian/watch file - though we won't use it internally due to the
  multiple tarball issues.
* Begin to simplify debian/rules a little by trimming dead code.
* Don't set SHELL = /bin/bash in debian/rules, no bashisms found in
  the current package.
* debian/patches/ft2demos-grkey.patch: don't point grKEY() at an enum when
  it's being passed values that aren't defined in that enum, fixing a build
  failure with gcc 4.5. Thanks to Brian M. Carlson for the preliminary
  patch. Closes: #564989.
* docs/PATENTS no longer exists, so we don't install it.
* Add ${misc:Depends} substitutions to all packages, per lintian.
* Standards-Version to 3.8.4, no changes required.
* Clarify in debian/copyright that freetype can be used under GPLv2 or
  later.

27. By Mario Limonciello on 2009-12-01

Revert last change. I really did have a FTBFS that "looked" like this
was the cause, but it's actually something else that dropped it's
dependency on libfreetype6-dev.

26. By Mario Limonciello on 2009-11-29

* debian/libfreetype6.files:
  - Correct an extra period that was placed causing other packages to
    FTBFS when linking against freetype.

Branch metadata

Branch format:
Branch format 7
Repository format:
Bazaar repository format 2a (needs bzr 1.16 or later)
Stacked on:
lp:ubuntu/natty/freetype
This branch contains Public information 
Everyone can see this information.

Subscribers