Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
(Red Hat Issues Fix for FreeType) Apple iOS Bugs Let Remote Users Execute Arbitrary Code and Obtain Information and Let Local Users Bypass Authentication
|
|
SecurityTracker Alert ID: 1026635 |
|
SecurityTracker URL: http://securitytracker.com/id/1026635
|
|
CVE Reference:
CVE-2011-3439
(Links to External Site)
|
Date: Feb 3 2012
|
Impact:
Disclosure of system information, Execution of arbitrary code via network, User access via local system, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
Several vulnerabilities were reported in Apple iOS. A remote user can cause arbitrary code to be executed on the target user's system. A physically local user can bypass authentication. A remote user can obtain potentially sensitive information. FreeType is affected by some of these vulnerabilities.
A remote user can create a specially crafted FreeType font that, when loaded by the target user, will execute arbitrary code on the target user's system [CVE-2011-3439].
A remote user can create specially crafted HTML that, when loaded by the target user, will cause libinfo to disclose potentially sensitive information via DNS name lookups [CVE-2011-3441]. Erling Ellingsen of Facebook and Per Johansson of Blocket AB reported this vulnerability.
A physically local user can open an iPad 2 Smart Cover while the device is confirming power off in the locked state to bypass the authentication passcode request [CVE-2011-3440]. The user cannot launch apps or access data protected by Data Protection.
|
Impact:
A remote user can create content that, when loaded by the target user, will execute arbitrary code on or obtain potentially sensitive information from the target user's system.
A physically local user can bypass the iPad 2 authentication passcode request in certain cases.
|
Solution:
Red Hat has issued a fix for CVE-2011-3439 for FreeType.
The Red Hat advisory is available at:
https://rhn.redhat.com/errata/RHSA-2012-0094.html
|
Cause:
Access control error
|
Underlying OS:
Linux (Red Hat Enterprise)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Thu, 2 Feb 2012 22:53:55 +0000
Subject: [RHSA-2012:0094-01] Important: freetype security update
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: freetype security update
Advisory ID: RHSA-2012:0094-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-0094.html
Issue date: 2012-02-02
CVE Names: CVE-2011-3256 CVE-2011-3439
=====================================================================
1. Summary:
Updated freetype packages that fix multiple security issues are now
available for Red Hat Enterprise Linux 5.6 Extended Update Support.
The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS)
base scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux EUS (v. 5.6 server) - i386, ia64, ppc, s390x, x86_64
3. Description:
FreeType is a free, high-quality, portable font engine that can open and
manage font files. It also loads, hints, and renders individual glyphs
efficiently.
Multiple input validation flaws were found in the way FreeType processed
bitmap font files. If a specially-crafted font file was loaded by an
application linked against FreeType, it could cause the application to
crash or, potentially, execute arbitrary code with the privileges of the
user running the application. (CVE-2011-3256)
Multiple input validation flaws were found in the way FreeType processed
CID-keyed fonts. If a specially-crafted font file was loaded by an
application linked against FreeType, it could cause the application to
crash or, potentially, execute arbitrary code with the privileges of the
user running the application. (CVE-2011-3439)
Users are advised to upgrade to these updated packages, which contain
backported patches to correct these issues. The X server must be restarted
(log out, then log back in) for this update to take effect.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
5. Bugs fixed (http://bugzilla.redhat.com/):
746226 - CVE-2011-3256 FreeType FT_Bitmap_New integer overflow to buffer overflow, FreeType TT_Vary_Get_Glyph_Deltas improper input validation
753799 - CVE-2011-3439 freetype: Multiple security flaws when loading CID-keyed Type 1 fonts
6. Package List:
Red Hat Enterprise Linux EUS (v. 5.6 server):
Source:
freetype-2.2.1-28.el5_6.1.src.rpm
i386:
freetype-2.2.1-28.el5_6.1.i386.rpm
freetype-debuginfo-2.2.1-28.el5_6.1.i386.rpm
freetype-demos-2.2.1-28.el5_6.1.i386.rpm
freetype-devel-2.2.1-28.el5_6.1.i386.rpm
ia64:
freetype-2.2.1-28.el5_6.1.i386.rpm
freetype-2.2.1-28.el5_6.1.ia64.rpm
freetype-debuginfo-2.2.1-28.el5_6.1.i386.rpm
freetype-debuginfo-2.2.1-28.el5_6.1.ia64.rpm
freetype-demos-2.2.1-28.el5_6.1.ia64.rpm
freetype-devel-2.2.1-28.el5_6.1.ia64.rpm
ppc:
freetype-2.2.1-28.el5_6.1.ppc.rpm
freetype-2.2.1-28.el5_6.1.ppc64.rpm
freetype-debuginfo-2.2.1-28.el5_6.1.ppc.rpm
freetype-debuginfo-2.2.1-28.el5_6.1.ppc64.rpm
freetype-demos-2.2.1-28.el5_6.1.ppc.rpm
freetype-devel-2.2.1-28.el5_6.1.ppc.rpm
freetype-devel-2.2.1-28.el5_6.1.ppc64.rpm
s390x:
freetype-2.2.1-28.el5_6.1.s390.rpm
freetype-2.2.1-28.el5_6.1.s390x.rpm
freetype-debuginfo-2.2.1-28.el5_6.1.s390.rpm
freetype-debuginfo-2.2.1-28.el5_6.1.s390x.rpm
freetype-demos-2.2.1-28.el5_6.1.s390x.rpm
freetype-devel-2.2.1-28.el5_6.1.s390.rpm
freetype-devel-2.2.1-28.el5_6.1.s390x.rpm
x86_64:
freetype-2.2.1-28.el5_6.1.i386.rpm
freetype-2.2.1-28.el5_6.1.x86_64.rpm
freetype-debuginfo-2.2.1-28.el5_6.1.i386.rpm
freetype-debuginfo-2.2.1-28.el5_6.1.x86_64.rpm
freetype-demos-2.2.1-28.el5_6.1.x86_64.rpm
freetype-devel-2.2.1-28.el5_6.1.i386.rpm
freetype-devel-2.2.1-28.el5_6.1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2011-3256.html
https://www.redhat.com/security/data/cve/CVE-2011-3439.html
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFPKxP2XlSAg2UNWIIRAjurAJwKoNnO3kO/eCYy/Ik2qr5FFglEwgCfeGfz
wuUKAtusuteQw1anUlEZSTI=
=Z2Z4
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
|
|
Go to the Top of This SecurityTracker Archive Page
|
