FreeType contains an overflow condition in the src/winfonts/winfnt.c. The issue is triggered as user-supplied input is not properly validated when handling crafted glyph-outline data in a font. With a specially crafted font, a context-dependent attacker can cause a heap-based buffer overflow, resulting in a denial of service or potentially execution of arbitrary code.

The FreeType Project has released a patch in the GIT repository to address this vulnerability. This patch will be included in version 2.4.9. Check the vendor advisory or solution in the references section.

• Security Tracker: 1026765
• CVE ID: 2012-1142 (see also: NVD)
• Secunia Advisory ID: 48268 48300 48508 48758 48797 48805 48822 48918 48951 48973 49721 50586
• Related OSVDB ID: 79872 79873 79874 79875 79876 79877 79878 79880 79881 79882 79883 79884 79885 79886 79887 79888 79890 79891
• Vendor Specific Solution URL: http://freetype.sourceforge.net/index2.html
• Vendor Specific News/Changelog Entry: http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00002.html
  http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html
  http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00004.html
  http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00015.html
  http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00018.html
  http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00020.html
  http://security.gentoo.org/glsa/glsa-201204-04.xml
  http://slackware.com/security/viewer.php?l=slackware-security&y=2012&m=slackware-security.499108
  http://www.mozilla.org/security/announce/2012/mfsa2012-21.html
  http://www.ubuntu.com/usn/usn-1403-1
  http://www.us.debian.org/security/2012/dsa-2428
• Vendor Specific Advisory URL: http://support.apple.com/kb/HT5503
• Mail List Post: http://www.openwall.com/lists/oss-security/2012/03/06/16
• RedHat RHSA: RHSA-2012:0467

• Matthew 'j00ru' Jurczyk - Google Security Team