Ubuntu update for FreeType

1) Buffer overflow

EUVDB-ID: #VU11093

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-10244

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the The parse_charstrings function in type1/t1load.c due to a boundary error when it does not ensure that a font contains a glyph name. A remote attacker can send a specially crafted file, trigger buffer overflow and cause the service to crash.

Mitigation

Update the affected packages

Ubuntu 16.10:

libfreetype6 2.6.3-3ubuntu1.1

Ubuntu 16.04 LTS:

libfreetype6 2.6.1-0.1ubuntu2.1

Ubuntu 14.04 LTS:

libfreetype6 2.5.2-1ubuntu2.6

Ubuntu 12.04 LTS:

libfreetype6 2.4.8-1ubuntu2.4

Vulnerable software versions

Ubuntu: 12.04 - 16.10

External links

http://www.ubuntu.com/usn/usn-3237-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.