SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   FreeType Vendors:   freetype.org
(Red Hat Issues Fix for FreeType) Apple iOS Multiple Flaws Let Remote Users Execute Arbitrary Code, Conduct Cross-Site Scripting Attacks, and Deny Service and Let Local Users Obtain Information
SecurityTracker Alert ID:  1026634
SecurityTracker URL:  http://securitytracker.com/id/1026634
CVE Reference:   CVE-2011-3256   (Links to External Site)
Date:  Feb 3 2012
Impact:   Denial of service via network, Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via local system, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 5.6
Description:   Multiple vulnerabilities were reported in Apple iOS. A remote user can cause arbitrary code to be executed on the target user's system. A remote user can cause denial of service conditions. A remote user can conduct cross-site scripting attacks. A local user can obtain potentially sensitive information. FreeType is affected by some of these vulnerabilities.

The iPhone 3GS, iPhone 4, iPod touch (3rd generation and later), and iPad products are affected.

A local user can exploit a flaw in the keyboard to view the last character of a previously typed password [CVE-2011-3245]. Paul Mousdicas reported this vulnerability.

A remote user can create a specially crafted HTTP or HTTPS URL that, when loaded by the target user, will send cookies for the referenced domain to another domain [CVE-2011-3246]. Erling Ellingsen of Facebook reported this vulnerability.

CalDAV does not verify the SSL certificate. A remote user in a privileged network position may intercept user credentials sent between the target device and a CalDAV calendar server [CVE-2011-3253]. Leszek Tasiemski of nSense reported this vulnerability.

A remote user can create a specially crafted calendar invitation that, when loaded by the target user, will inject script in the local domain [CVE-2011-3254]. Versions prior to iOS 4.2.0 are not affected. Rick Deacon reported this vulnerability.

The system may log the user's AppleID password to a local file. A local user (application) may be able to access the credentials [CVE-2011-3255]. Peter Quade of qdevelop reported this vulnerability.

A remote user can create a specially crafted FreeType font that, when loaded by the target user, will execute arbitrary code on the target user's device [CVE-2011-3256]. The vendor reported this vulnerability.

When multiple mail exchange accounts are configured and connect to the same server, a session may be assigned a session cookie for a different account [CVE-2011-3257]. Bob Sielken of IBM reported this vulnerability.

A remote user with the ability to connect to a listening service on the target device can establish an incomplete TCP connection to consume excessive memory and cause the device to reset [CVE-2011-3259]. Wouter van der Veer of Topicus I&I and Josh Enders reported this vulnerability.

A remote user can create a specially crafted Word file that, when loaded by the target user, will trigger a buffer overflow and execute arbitrary code on the target device [CVE-2011-3260]. Tobias Klein (via Verisign iDefense Labs) reported this vulnerability.

A remote user can create a specially crafted Excel file that, when loaded by the target user, will trigger a double free memory error and execute arbitrary code on the target device [CVE-2011-3261]. Tobias Klein of www.trapkit.de reported this vulnerability.

A remote user can create a specially crafted file on a web site that, when loaded by the target user, will run arbitrary scripting code in the context of that site [CVE-2011-3426]. Christian Matthies (via iDefense VCP) and Yoshinori Oota from Business Architects Inc (via with JP/CERT) reported this vulnerability.

The system accepts certificates signed using MD5 and may expose X.509 protocols to spoofing, man in the middle attacks, and information disclosure [CVE-2011-3427].

A physically local user can access the parental restrictions password [CVE-2011-3429]. An anonymous researcher reported this vulnerability.

Some configuration settings applied via configuration profiles did not function properly uder non-English languages. As a result, settings may be improperly displayed [CVE-2011-3430]. Florian Kreitmaier of Siemens CERT reported this vulnerability.

A local user can switch betwee applications using the four-finger swipe gesture to cause the display to reveal the previous application state [CVE-2011-3431]. Abe White of Hedonic Software Inc. reported this vulnerability.

A remote user can create a specially crafted 'tel:' URI that, when loaded by the target user, will cause the target user's device to hang [CVE-2011-3432]. Simon Young of Anglia Ruskin University reported this vulnerability.

The system may log WiFi credentials to a local file. A local user (application) may be able to access the credentials [CVE-2011-3434]. Laurent OUDOT of TEHTRI Security reported this vulnerability.

Impact:   A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.

A remote user can cause denial of service conditions.

A local user can obtain potentially sensitive information.

A remote user can access the target user's cookies (including authentication cookies), if any, associated with a target site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

Solution:   Red Hat has issued a fix for CVE-2011-3256 for FreeType.

The Red Hat advisory is available at:

https://rhn.redhat.com/errata/RHSA-2012-0094.html

Cause:   Access control error, Boundary error, Input validation error, Resource error
Underlying OS:  Linux (Red Hat Enterprise)

Message History:   This archive entry is a follow-up to the message listed below.
Oct 13 2011 Apple iOS Multiple Flaws Let Remote Users Execute Arbitrary Code, Conduct Cross-Site Scripting Attacks, and Deny Service and Let Local Users Obtain Information



 Source Message Contents

Subject:  [RHSA-2012:0094-01] Important: freetype security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: freetype security update
Advisory ID:       RHSA-2012:0094-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2012-0094.html
Issue date:        2012-02-02
CVE Names:         CVE-2011-3256 CVE-2011-3439 
=====================================================================

1. Summary:

Updated freetype packages that fix multiple security issues are now
available for Red Hat Enterprise Linux 5.6 Extended Update Support.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS)
base scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux EUS (v. 5.6 server) - i386, ia64, ppc, s390x, x86_64

3. Description:

FreeType is a free, high-quality, portable font engine that can open and
manage font files. It also loads, hints, and renders individual glyphs
efficiently.

Multiple input validation flaws were found in the way FreeType processed
bitmap font files. If a specially-crafted font file was loaded by an
application linked against FreeType, it could cause the application to
crash or, potentially, execute arbitrary code with the privileges of the
user running the application. (CVE-2011-3256)

Multiple input validation flaws were found in the way FreeType processed
CID-keyed fonts. If a specially-crafted font file was loaded by an
application linked against FreeType, it could cause the application to
crash or, potentially, execute arbitrary code with the privileges of the
user running the application. (CVE-2011-3439)

Users are advised to upgrade to these updated packages, which contain
backported patches to correct these issues. The X server must be restarted
(log out, then log back in) for this update to take effect.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

746226 - CVE-2011-3256 FreeType FT_Bitmap_New integer overflow to buffer overflow, FreeType TT_Vary_Get_Glyph_Deltas improper input validation
753799 - CVE-2011-3439 freetype: Multiple security flaws when loading CID-keyed Type 1 fonts

6. Package List:

Red Hat Enterprise Linux EUS (v. 5.6 server):

Source:
freetype-2.2.1-28.el5_6.1.src.rpm

i386:
freetype-2.2.1-28.el5_6.1.i386.rpm
freetype-debuginfo-2.2.1-28.el5_6.1.i386.rpm
freetype-demos-2.2.1-28.el5_6.1.i386.rpm
freetype-devel-2.2.1-28.el5_6.1.i386.rpm

ia64:
freetype-2.2.1-28.el5_6.1.i386.rpm
freetype-2.2.1-28.el5_6.1.ia64.rpm
freetype-debuginfo-2.2.1-28.el5_6.1.i386.rpm
freetype-debuginfo-2.2.1-28.el5_6.1.ia64.rpm
freetype-demos-2.2.1-28.el5_6.1.ia64.rpm
freetype-devel-2.2.1-28.el5_6.1.ia64.rpm

ppc:
freetype-2.2.1-28.el5_6.1.ppc.rpm
freetype-2.2.1-28.el5_6.1.ppc64.rpm
freetype-debuginfo-2.2.1-28.el5_6.1.ppc.rpm
freetype-debuginfo-2.2.1-28.el5_6.1.ppc64.rpm
freetype-demos-2.2.1-28.el5_6.1.ppc.rpm
freetype-devel-2.2.1-28.el5_6.1.ppc.rpm
freetype-devel-2.2.1-28.el5_6.1.ppc64.rpm

s390x:
freetype-2.2.1-28.el5_6.1.s390.rpm
freetype-2.2.1-28.el5_6.1.s390x.rpm
freetype-debuginfo-2.2.1-28.el5_6.1.s390.rpm
freetype-debuginfo-2.2.1-28.el5_6.1.s390x.rpm
freetype-demos-2.2.1-28.el5_6.1.s390x.rpm
freetype-devel-2.2.1-28.el5_6.1.s390.rpm
freetype-devel-2.2.1-28.el5_6.1.s390x.rpm

x86_64:
freetype-2.2.1-28.el5_6.1.i386.rpm
freetype-2.2.1-28.el5_6.1.x86_64.rpm
freetype-debuginfo-2.2.1-28.el5_6.1.i386.rpm
freetype-debuginfo-2.2.1-28.el5_6.1.x86_64.rpm
freetype-demos-2.2.1-28.el5_6.1.x86_64.rpm
freetype-devel-2.2.1-28.el5_6.1.i386.rpm
freetype-devel-2.2.1-28.el5_6.1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2011-3256.html
https://www.redhat.com/security/data/cve/CVE-2011-3439.html
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFPKxP2XlSAg2UNWIIRAjurAJwKoNnO3kO/eCYy/Ik2qr5FFglEwgCfeGfz
wuUKAtusuteQw1anUlEZSTI=
=Z2Z4
-----END PGP SIGNATURE-----


-- 
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC