Debian Security Advisory DSA 2428-1 (freetype - Several Vulnerabilities) Network Vulnerability

Summary

Mateusz Jurczyk from the Google Security Team discovered several vulnerabilties in Freetype's parsing of BDF, Type1 and TrueType fonts, which could result in the execution of arbitrary code if a malformed font file is processed.

Solution

For the stable distribution (squeeze), this problem has been fixed in version 2.4.2-2.1+squeeze4. The updated packages are already available since yesterday, but the advisory text couldn't be send earlier. For the unstable distribution (sid), this problem will be fixed soon. We recommend that you upgrade your freetype packages.

Insight

The FreeType 2 library is a software font engine.

Affected

freetype on Debian Linux

Detection

This check tests the installed software version using the apt package manager.

References