Summary
The remote host is missing an update to freetype
announced via advisory DSA 1784-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201784-1
Insight
Tavis Ormandy discovered several integer overflows in FreeType, a library to process and access font files, resulting in heap- or stack-based buffer overflows leading to application crashes or the execution of arbitrary code via a crafted font file.
For the oldstable distribution (etch), this problem has been fixed in version 2.2.1-5+etch4.
For the stable distribution (lenny), this problem has been fixed in version 2.3.7-2+lenny1.
For the testing distribution (squeeze), this problem will be fixed soon.
For the unstable distribution (sid), this problem has been fixed in version 2.3.9-4.1.
We recommend that you upgrade your freetype packages.
Severity
Classification
-
CVE CVE-2009-0946 -
CVSS Base Score: 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities