FreeType contains an overflow condition in the src/truetype/ttinterp.c. The issue is triggered as user-supplied input is not properly validated when an error occurs in the TrueType Bytecode Interpreter during the handling of an MIRP instruction. With a specially crafted instruction, a context-dependent attacker can cause a heap-based buffer overflow, resulting in a denial of service or potentially execution of arbitrary code.

The FreeType Project has released a patch in the GIT repository to address this vulnerability. This patch will be included in version 2.4.9. Check the vendor advisory or solution in the references section.

• Security Tracker: 1026765
• CVE ID: 2012-1138 (see also: NVD)
• Secunia Advisory ID: 48268 48508 48797 48805 48822 48918 48951 48973 49721 50586
• Related OSVDB ID: 79872 79873 79874 79875 79876 79877 79878 79880 79881 79882 79883 79884 79886 79887 79888 79889 79890 79891
• Vendor Specific Solution URL: http://freetype.sourceforge.net/index2.html
  http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=a33c013fe2dc6e65de2879682201d9c155292349
• Vendor Specific News/Changelog Entry: http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00002.html
  http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html
  http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00004.html
  http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00015.html
  http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00018.html
  http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00020.html
  http://security.gentoo.org/glsa/glsa-201204-04.xml
  http://slackware.com/security/viewer.php?l=slackware-security&y=2012&m=slackware-security.499108
  http://www.mozilla.org/security/announce/2012/mfsa2012-21.html
  http://www.ubuntu.com/usn/usn-1403-1
  https://bugzilla.redhat.com/show_bug.cgi?id=800597
• Vendor Specific Advisory URL: http://support.apple.com/kb/HT5503
  https://savannah.nongnu.org/bugs/?35646
• Mail List Post: http://www.openwall.com/lists/oss-security/2012/03/06/16

• Matthew 'j00ru' Jurczyk - Google Security Team