[Full-disclosure] [ MDVSA-2009:243-1 ] freetype2

[security@xxxxxxxxxxxx]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                       MDVSA-2009:243-1
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : freetype2
 Date    : September 22, 2009
 Affected: 2009.1
 _______________________________________________________________________

 Problem Description:

 Multiple integer overflows in FreeType 2.3.9 and earlier allow remote
 attackers to execute arbitrary code via vectors related to large
 values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c,
 and (3) cff/cffload.c.
 
 This update corrects the problem.

 Update:

 Correct a problem in the 2009.1 update of the lzw handling code.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0946
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2009.1:
 f108254fbde4df7a0b36ca1985a9fb33  
2009.1/i586/libfreetype6-2.3.9-1.2mdv2009.1.i586.rpm
 035e670c22b49b87695c9f05acb8934a  
2009.1/i586/libfreetype6-devel-2.3.9-1.2mdv2009.1.i586.rpm
 71c14147686855d6bfd784b13620253f  
2009.1/i586/libfreetype6-static-devel-2.3.9-1.2mdv2009.1.i586.rpm 
 222b4d88df142524f60b5bbb91854f8d  
2009.1/SRPMS/freetype2-2.3.9-1.2mdv2009.1.src.rpm

 Mandriva Linux 2009.1/X86_64:
 01af6de5f9ea9efe4791468762b17177  
2009.1/x86_64/lib64freetype6-2.3.9-1.2mdv2009.1.x86_64.rpm
 2612b961ba878228925cc79b40134f95  
2009.1/x86_64/lib64freetype6-devel-2.3.9-1.2mdv2009.1.x86_64.rpm
 1fe30e15897c5e6a3004a29106ac3f8c  
2009.1/x86_64/lib64freetype6-static-devel-2.3.9-1.2mdv2009.1.x86_64.rpm 
 222b4d88df142524f60b5bbb91854f8d  
2009.1/SRPMS/freetype2-2.3.9-1.2mdv2009.1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFKupCxmqjQ0CJFipgRAh2IAKCkPqZFYMq/a0wal5h2YD9Loor9CQCgusic
74FufvNPSpk6R4dU0n2qFos=
=DkXg
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/