FreeType contains an overflow condition in src/bdf/bdflib.c. The issue is triggered as user-supplied input is not properly validated when adding properties. With a specially crafted Bitmap Distribution Format (BDF) font file, a context-dependent attacker can cause a heap-based buffer overflow, resulting in a denial of service or potentially execution of arbitrary code.

The FreeType Project has released a patch in the GIT repository to address this vulnerability. This patch will be included in version 2.4.9. Check the vendor advisory or solution in the references section.

• Security Tracker: 1026765
• CVE ID: 2012-1126 (see also: NVD)
• Secunia Advisory ID: 48268 48508 48758 48797 48805 48822 48918 48951 48973 49721 50586
• Related OSVDB ID: 79873 79874 79875 79876 79877 79878 79880 79881 79882 79883 79884 79885 79886 79887 79888 79889 79890 79891
• Vendor Specific Solution URL: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=320d4976d1d010b5abe9d61a7423d8ca06bc34df
• Vendor Specific News/Changelog Entry: http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00002.html
  http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html
  http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00004.html
  http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00015.html
  http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00018.html
  http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00020.html
  http://security.gentoo.org/glsa/glsa-201204-04.xml
  http://slackware.com/security/viewer.php?l=slackware-security&y=2012&m=slackware-security.499108
  http://www.mozilla.org/security/announce/2012/mfsa2012-21.html
  http://www.ubuntu.com/usn/usn-1403-1
  https://bugzilla.mozilla.org/show_bug.cgi?id=733512
  https://bugzilla.redhat.com/show_bug.cgi?id=800581
• Vendor Specific Advisory URL: http://support.apple.com/kb/HT5503
  https://savannah.nongnu.org/bugs/?35597
  https://savannah.nongnu.org/bugs/?35598
• Vendor URL: http://www.freetype.org/
• Mail List Post: http://www.openwall.com/lists/oss-security/2012/03/06/16
• RedHat RHSA: RHSA-2012:0467

• Matthew 'j00ru' Jurczyk - Google Security Team