FreeType Integer Overflow in TT_Load_Simple_Glyph() Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1018088
|
|
SecurityTracker URL: http://securitytracker.com/id?1018088
|
|
CVE Reference: CVE-2007-2754
(Links to External Site)
|
Date: May 21 2007
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 2.3.4 and prior versions
|
Description: A vulnerability was reported in FreeType. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create a specially crafted TTF image that, when loaded by the target user or application, will trigger an integer
overflow in TT_Load_Simple_Glyph() and execute arbitrary code on the target system. The code will run with the privileges of the
target user or application.
The vulnerability resides in 'truetype/ttgload.c'.
Victor Stinner reported this vulnerability.
|
Impact: A remote user can create an image that, when loaded by the target user, will execute arbitrary code on the target user's system.
|
Solution: The vendor has issued a source code fix, available at:
http://cvs.savannah.nongnu.org/viewvc/freetype2/src/truetype/ttgload.c?root=freetype&r1=1.177&r2=1.178
|
Vendor URL: www.freetype.org/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: Victor Stinner <nouser@nohost.nodomain>
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Fri, 27 Apr 2007 17:03:02 +0200
From: Victor Stinner <nouser@nohost.nodomain>
Subject: [ft-devel] Bug in fuzzed TTF file
|
Hi,
I wrote a fuzzer and tried it on Image Magick. I found some bugs and one
critical in TTF format. I don't want to publish to much informations since I
think that it's a serious security bug (may lead to arbitrary code
execution).
It's hard to track the error but it's near line 325 in src/truetype/ttgload.c
(function Get_VMetrics()). Status of the function on the crash:
n_contours = 1
n_points = -12526 (negative)
tags = NULL
Problems:
signed/unsigned integers conversion (stange instruction: « cont[0] =
FT_GET_USHORT(); ») --> negative number of points
tags in NULL (why?)
Contact me if you would like to get more informations or the bug to reproduce
the bug.
Does Freetype use a bug tracker? Is the source repository (cvs/svn) public?
Victor
--
Victor Stinner
http://www.inl.fr/
|
|
