[ GLSA 202010-07 ] FreeType

[GLSA]

Gentoo Linux Security Advisory

Title: FreeType: Arbitrary code execution (GLSA 202010-07)
Severity: normal
Exploitable: remote
Date: 2020-10-23
Bug(s): #750275
ID: 202010-07

Synopsis

A buffer overflow in FreeType might allow remote attacker(s) to
execute arbitrary code.


Background

FreeType is a high-quality and portable font engine.

Affected Packages

Package: media-libs/freetype
Vulnerable: < 2.10.3-r1
Unaffected: >= 2.10.3-r1
Architectures: All supported architectures


Description

A flaw in FreeType’s handling of embedded PNG bitmaps was discovered
where the image height and width was not checked to be within bounds.


Impact

A remote attacker could entice a user to open a specially crafted font
file using FreeType possibly resulting in the execution of arbitrary code
with the privileges of the process or a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All FreeType users should upgrade to the latest version: