[ubuntu/precise] freetype 2.4.8-1ubuntu1 (Accepted)

Thu Mar 29 15:45:52 UTC 2012

freetype (2.4.8-1ubuntu1) precise; urgency=low

  * SECURITY UPDATE: Denial of service via crafted BDF font (LP: #963283)
    - debian/patches-freetype/CVE-2012-1126.patch: Perform better input
      sanitization when parsing properties. Based on upstream patch.
    - CVE-2012-1126
  * SECURITY UPDATE: Denial of service via crafted BDF font
    - debian/patches-freetype/CVE-2012-1127.patch: Perform better input
      sanitization when parsing glyphs. Based on upstream patch.
    - CVE-2012-1127
  * SECURITY UPDATE: Denial of service via crafted TrueType font
    - debian/patches-freetype/CVE-2012-1128.patch: Improve loop logic to avoid
      NULL pointer dereference. Based on upstream patch.
    - CVE-2012-1128
  * SECURITY UPDATE: Denial of service via crafted Type42 font
    - debian/patches-freetype/CVE-2012-1129.patch: Perform better input
      sanitization when parsing SFNT strings. Based on upstream patch.
    - CVE-2012-1129
  * SECURITY UPDATE: Denial of service via crafted PCF font
    - debian/patches-freetype/CVE-2012-1130.patch: Allocate enough memory to
      properly NULL-terminate parsed properties strings. Based on upstream
      patch.
    - CVE-2012-1130
  * SECURITY UPDATE: Denial of service via crafted TrueType font
    - debian/patches-freetype/CVE-2012-1131.patch: Use appropriate data type to
      prevent integer truncation on 64 bit systems when rendering fonts. Based
      on upstream patch.
    - CVE-2012-1131
  * SECURITY UPDATE: Denial of service via crafted Type1 font
    - debian/patches-freetype/CVE-2012-1132.patch: Ensure strings are of
      appropriate length when loading Type1 fonts. Based on upstream patch.
    - CVE-2012-1132
  * SECURITY UPDATE: Denial of service and arbitrary code execution via
    crafted BDF font
    - debian/patches-freetype/CVE-2012-1133.patch: Limit range of negative
      glyph encoding values to prevent invalid array indexes. Based on
      upstream patch.
    - CVE-2012-1133
  * SECURITY UPDATE: Denial of service and arbitrary code execution via
    crafted Type1 font
    - debian/patches-freetype/CVE-2012-1134.patch: Enforce a minimum Type1
      private dictionary size to prevent writing past array bounds. Based on
      upstream patch.
    - CVE-2012-1134
  * SECURITY UPDATE: Denial of service via crafted TrueType font
    - debian/patches-freetype/CVE-2012-1135.patch: Perform proper bounds
      checks when interpreting TrueType bytecode. Based on upstream patch.
    - CVE-2012-1135
  * SECURITY UPDATE: Denial of service and arbitrary code execution via
    crafted BDF font
    - debian/patches-freetype/CVE-2012-1136.patch: Ensure encoding field is
      defined when parsing glyphs. Based on upstream patch.
    - CVE-2012-1136
  * SECURITY UPDATE: Denial of service via crafted BDF font
    - debian/patches-freetype/CVE-2012-1137.patch: Allocate sufficient number
      of array elements to prevent reading past array bounds. Based on
      upstream patch.
    - CVE-2012-1137
  * SECURITY UPDATE: Denial of service via crafted TrueType font
    - debian/patches-freetype/CVE-2012-1138.patch: Correct typo resulting in
      invalid read from wrong memory location. Based on upstream patch.
    - CVE-2012-1138
  * SECURITY UPDATE: Denial of service via crafted BDF font
    - debian/patches-freetype/CVE-2012-1139.patch: Check array index values to
      prevent reading invalid memory. Based on upstream patch.
    - CVE-2012-1139
  * SECURITY UPDATE: Denial of service via crafted PostScript font
    - debian/patches-freetype/CVE-2012-1140.patch: Fix off-by-one error in
      boundary checks. Based on upstream patch.
    - CVE-2012-1140
  * SECURITY UPDATE: Denial of service via crafted BDF font
    - debian/patches-freetype/CVE-2012-1141.patch: Initialize field elements
      to prevent invalid read. Based on upstream patch.
    - CVE-2012-1141
  * SECURITY UPDATE: Denial of service via crafted Windows FNT/FON font
    - debian/patches-freetype/CVE-2012-1142.patch: Perform input sanitization
      on first and last character code fields. Based on upstream patch.
    - CVE-2012-1142
  * SECURITY UPDATE: Denial of service via crafted font
    - debian/patches-freetype/CVE-2012-1143.patch: Protect against divide by
      zero when dealing with 32 bit types. Based on upstream patch.
    - CVE-2012-1143
  * SECURITY UPDATE: Denial of service and arbitrary code execution via
    crafted TrueType font
    - debian/patches-freetype/CVE-2012-1144.patch: Perform input sanitization
      on the first glyph outline point value. Based on upstream patch.
    - CVE-2012-1144

Date: Fri, 23 Mar 2012 12:13:46 -0500
Changed-By: Tyler Hicks <tyhicks at canonical.com>
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Signed-By: Jamie Strandboge <jamie at ubuntu.com>
https://launchpad.net/ubuntu/precise/+source/freetype/2.4.8-1ubuntu1
-------------- next part --------------
Format: 1.8
Date: Fri, 23 Mar 2012 12:13:46 -0500
Source: freetype
Binary: libfreetype6 libfreetype6-dev freetype2-demos libfreetype6-udeb
Architecture: source
Version: 2.4.8-1ubuntu1
Distribution: precise
Urgency: low
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Tyler Hicks <tyhicks at canonical.com>
Description: 
 freetype2-demos - FreeType 2 demonstration programs
 libfreetype6 - FreeType 2 font engine, shared library files
 libfreetype6-dev - FreeType 2 font engine, development files
 libfreetype6-udeb - FreeType 2 font engine for the debian-installer (udeb)
Launchpad-Bugs-Fixed: 963283
Changes: 
 freetype (2.4.8-1ubuntu1) precise; urgency=low
 .
   * SECURITY UPDATE: Denial of service via crafted BDF font (LP: #963283)
     - debian/patches-freetype/CVE-2012-1126.patch: Perform better input
       sanitization when parsing properties. Based on upstream patch.
     - CVE-2012-1126
   * SECURITY UPDATE: Denial of service via crafted BDF font
     - debian/patches-freetype/CVE-2012-1127.patch: Perform better input
       sanitization when parsing glyphs. Based on upstream patch.
     - CVE-2012-1127
   * SECURITY UPDATE: Denial of service via crafted TrueType font
     - debian/patches-freetype/CVE-2012-1128.patch: Improve loop logic to avoid
       NULL pointer dereference. Based on upstream patch.
     - CVE-2012-1128
   * SECURITY UPDATE: Denial of service via crafted Type42 font
     - debian/patches-freetype/CVE-2012-1129.patch: Perform better input
       sanitization when parsing SFNT strings. Based on upstream patch.
     - CVE-2012-1129
   * SECURITY UPDATE: Denial of service via crafted PCF font
     - debian/patches-freetype/CVE-2012-1130.patch: Allocate enough memory to
       properly NULL-terminate parsed properties strings. Based on upstream
       patch.
     - CVE-2012-1130
   * SECURITY UPDATE: Denial of service via crafted TrueType font
     - debian/patches-freetype/CVE-2012-1131.patch: Use appropriate data type to
       prevent integer truncation on 64 bit systems when rendering fonts. Based
       on upstream patch.
     - CVE-2012-1131
   * SECURITY UPDATE: Denial of service via crafted Type1 font
     - debian/patches-freetype/CVE-2012-1132.patch: Ensure strings are of
       appropriate length when loading Type1 fonts. Based on upstream patch.
     - CVE-2012-1132
   * SECURITY UPDATE: Denial of service and arbitrary code execution via
     crafted BDF font
     - debian/patches-freetype/CVE-2012-1133.patch: Limit range of negative
       glyph encoding values to prevent invalid array indexes. Based on
       upstream patch.
     - CVE-2012-1133
   * SECURITY UPDATE: Denial of service and arbitrary code execution via
     crafted Type1 font
     - debian/patches-freetype/CVE-2012-1134.patch: Enforce a minimum Type1
       private dictionary size to prevent writing past array bounds. Based on
       upstream patch.
     - CVE-2012-1134
   * SECURITY UPDATE: Denial of service via crafted TrueType font
     - debian/patches-freetype/CVE-2012-1135.patch: Perform proper bounds
       checks when interpreting TrueType bytecode. Based on upstream patch.
     - CVE-2012-1135
   * SECURITY UPDATE: Denial of service and arbitrary code execution via
     crafted BDF font
     - debian/patches-freetype/CVE-2012-1136.patch: Ensure encoding field is
       defined when parsing glyphs. Based on upstream patch.
     - CVE-2012-1136
   * SECURITY UPDATE: Denial of service via crafted BDF font
     - debian/patches-freetype/CVE-2012-1137.patch: Allocate sufficient number
       of array elements to prevent reading past array bounds. Based on
       upstream patch.
     - CVE-2012-1137
   * SECURITY UPDATE: Denial of service via crafted TrueType font
     - debian/patches-freetype/CVE-2012-1138.patch: Correct typo resulting in
       invalid read from wrong memory location. Based on upstream patch.
     - CVE-2012-1138
   * SECURITY UPDATE: Denial of service via crafted BDF font
     - debian/patches-freetype/CVE-2012-1139.patch: Check array index values to
       prevent reading invalid memory. Based on upstream patch.
     - CVE-2012-1139
   * SECURITY UPDATE: Denial of service via crafted PostScript font
     - debian/patches-freetype/CVE-2012-1140.patch: Fix off-by-one error in
       boundary checks. Based on upstream patch.
     - CVE-2012-1140
   * SECURITY UPDATE: Denial of service via crafted BDF font
     - debian/patches-freetype/CVE-2012-1141.patch: Initialize field elements
       to prevent invalid read. Based on upstream patch.
     - CVE-2012-1141
   * SECURITY UPDATE: Denial of service via crafted Windows FNT/FON font
     - debian/patches-freetype/CVE-2012-1142.patch: Perform input sanitization
       on first and last character code fields. Based on upstream patch.
     - CVE-2012-1142
   * SECURITY UPDATE: Denial of service via crafted font
     - debian/patches-freetype/CVE-2012-1143.patch: Protect against divide by
       zero when dealing with 32 bit types. Based on upstream patch.
     - CVE-2012-1143
   * SECURITY UPDATE: Denial of service and arbitrary code execution via
     crafted TrueType font
     - debian/patches-freetype/CVE-2012-1144.patch: Perform input sanitization
       on the first glyph outline point value. Based on upstream patch.
     - CVE-2012-1144
Checksums-Sha1: 
 43c09a1cfdd230818bd8765de0dc324032ec5bd7 2141 freetype_2.4.8-1ubuntu1.dsc
 b675f833cd1e1490fb1536f7242ed52820f67bb6 42712 freetype_2.4.8-1ubuntu1.diff.gz
Checksums-Sha256: 
 8eccc0acb059b9e846a4d38caf5ad467f698e9c86c9db2fd1d73991c0c64ce56 2141 freetype_2.4.8-1ubuntu1.dsc
 7e8e733a0365623dfa323e8ad2764e57032149c31511a437c4161af4519a539b 42712 freetype_2.4.8-1ubuntu1.diff.gz
Files: 
 67ac1844909971c0b0514f379b81d257 2141 libs optional freetype_2.4.8-1ubuntu1.dsc
 62b2de0747fe8359611a1535e3c5647a 42712 libs optional freetype_2.4.8-1ubuntu1.diff.gz
Original-Maintainer: Steve Langasek <vorlon at debian.org>