Vulnerabilities > CVE-2011-0226 - Numeric Errors vulnerability in multiple products

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
freetype
apple
CWE-189
critical
nessus

Summary

Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Type 1 font in a PDF document, as exploited in the wild in July 2011.

Vulnerable Configurations

Part Description Count
Application
Freetype
44
OS
Apple
85

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_5D374B01C3EE11E08AA5485D60CB5385.NASL
    descriptionVincent Danen reports : Due to an error within the t1_decoder_parse_charstrings() function (src/psaux/t1decode.c) and can be exploited to corrupt memory by tricking a user into processing a specially crafted postscript Type1 font in an application that uses the freetype library.
    last seen2020-06-01
    modified2020-06-02
    plugin id55822
    published2011-08-12
    reporterThis script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/55822
    titleFreeBSD : freetype2 -- execute arbitrary code or cause denial of service (5d374b01-c3ee-11e0-8aa5-485d60cb5385)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2011-1085.NASL
    descriptionFrom Red Hat Security Advisory 2011:1085 : Updated freetype packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently. These packages provide the FreeType 2 font engine. A flaw was found in the way the FreeType font rendering engine processed certain PostScript Type 1 fonts. If a user loaded a specially crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2011-0226) Users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The X server must be restarted (log out, then log back in) for this update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id68311
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/68311
    titleOracle Linux 6 : freetype (ELSA-2011-1085)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_10_7_2.NASL
    descriptionThe remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.2. This version contains numerous security-related fixes for the following components : - Apache - Application Firewall - ATS - BIND - Certificate Trust Policy - CFNetwork - CoreMedia - CoreProcesses - CoreStorage - File Systems - iChat Server - Kernel - libsecurity - Open Directory - PHP - python - QuickTime - SMB File Server - X11
    last seen2020-06-01
    modified2020-06-02
    plugin id56480
    published2011-10-13
    reporterThis script is Copyright (C) 2011-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/56480
    titleMac OS X 10.7.x < 10.7.2 Multiple Vulnerabilities
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2011-08.NASL
    descriptionThe MITRE CVE database describes CVE-2011-3256 as : FreeType 2 before 2.4.7, as used in CoreGraphics in Apple iOS before 5, Mandriva Enterprise Server 5, and possibly other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font, a different vulnerability than CVE-2011-0226.
    last seen2020-06-01
    modified2020-06-02
    plugin id69567
    published2013-09-04
    reporterThis script is Copyright (C) 2013-2015 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/69567
    titleAmazon Linux AMI : freetype (ALAS-2011-08)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_4_FREETYPE2-110722.NASL
    descriptionThis freetype2 update fixes sign extension problems and missing length checks. This issue was used in one of the last jailbreakme exploits for Apple iPhone/iPad products. (CVE-2011-0226)
    last seen2020-06-01
    modified2020-06-02
    plugin id75844
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75844
    titleopenSUSE Security Update : freetype2 (openSUSE-SU-2011:0852-1)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2011-9525.NASL
    descriptionThis update fixes CVE-2011-0226. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id56016
    published2011-08-31
    reporterThis script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/56016
    titleFedora 14 : freetype-2.4.2-5.fc14 (2011-9525)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2294.NASL
    descriptionIt was discovered that insufficient input sanitising in Freetype
    last seen2020-03-17
    modified2011-08-16
    plugin id55852
    published2011-08-16
    reporterThis script is Copyright (C) 2011-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/55852
    titleDebian DSA-2294-1 : freetype - missing input sanitising
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_3_FREETYPE2-110722.NASL
    descriptionThis freetype2 update fixes sign extension problems and missing length checks. This issue was used in one of the last jailbreakme exploits for Apple iPhone/iPad products. (CVE-2011-0226)
    last seen2020-06-01
    modified2020-06-02
    plugin id75506
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75506
    titleopenSUSE Security Update : freetype2 (openSUSE-SU-2011:0852-1)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2011-120.NASL
    descriptionA vulnerability was discovered and corrected in freetype2 : Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Type 1 font in a PDF document, as exploited in the wild in July 2011 (CVE-2011-0226). Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/product_info.php?cPath=149 products_id=490 The updated packages have been patched to correct this issue.
    last seen2020-06-01
    modified2020-06-02
    plugin id55695
    published2011-07-27
    reporterThis script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/55695
    titleMandriva Linux Security Advisory : freetype2 (MDVSA-2011:120)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2011-1085.NASL
    descriptionUpdated freetype packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently. These packages provide the FreeType 2 font engine. A flaw was found in the way the FreeType font rendering engine processed certain PostScript Type 1 fonts. If a user loaded a specially crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2011-0226) Users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The X server must be restarted (log out, then log back in) for this update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id55647
    published2011-07-22
    reporterThis script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/55647
    titleRHEL 6 : freetype (RHSA-2011:1085)
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS11_LIBFXT_20141107.NASL
    descriptionThe remote Solaris system is missing necessary patches to address security updates : - FreeType 2 before 2.4.7, as used in CoreGraphics in Apple iOS before 5, Mandriva Enterprise Server 5, and possibly other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font, a different vulnerability than CVE-2011-0226. (CVE-2011-3256)
    last seen2020-06-01
    modified2020-06-02
    plugin id80670
    published2015-01-19
    reporterThis script is Copyright (C) 2015-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/80670
    titleOracle Solaris Third-Party Patch Update : libfxt (cve_2011_3256_denial_of)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1173-1.NASL
    descriptionIt was discovered that FreeType did not correctly handle certain malformed Type 1 font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash or possibly execute arbitrary code with user privileges. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id55688
    published2011-07-26
    reporterUbuntu Security Notice (C) 2011-2019 Canonical, Inc. / NASL script (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/55688
    titleUbuntu 10.10 / 11.04 : freetype vulnerability (USN-1173-1)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2011-9542.NASL
    descriptionThis update fixes CVE-2011-0226. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id55872
    published2011-08-17
    reporterThis script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/55872
    titleFedora 15 : freetype-2.4.4-5.fc15 (2011-9542)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20110721_FREETYPE_ON_SL6_X.NASL
    descriptionFreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently. These packages provide the FreeType 2 font engine. A flaw was found in the way the FreeType font rendering engine processed certain PostScript Type 1 fonts. If a user loaded a specially crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2011-0226) Users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The X server must be restarted (log out, then log back in) for this update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id61089
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61089
    titleScientific Linux Security Update : freetype on SL6.x i386/x86_64
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_FREETYPE2-110726.NASL
    descriptionThis update fixes length checks in psaux/psobjs.c. This issue was used in one of the last jailbreakme exploits for Apple iPhone/iPad products. (CVE-2011-0226)
    last seen2020-06-01
    modified2020-06-02
    plugin id55712
    published2011-07-28
    reporterThis script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/55712
    titleSuSE 11.1 Security Update : freetype2 (SAT Patch Number 4921)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201201-09.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201201-09 (FreeType: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in FreeType. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to open a specially crafted font, possibly resulting in the remote execution of arbitrary code with the privileges of the user running the application, or a Denial of Service. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id57651
    published2012-01-24
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/57651
    titleGLSA-201201-09 : FreeType: Multiple vulnerabilities

Redhat

advisories
bugzilla
id722701
titleCVE-2011-0226 freetype: postscript type1 font parsing vulnerability
oval
OR
  • commentRed Hat Enterprise Linux must be installed
    ovaloval:com.redhat.rhba:tst:20070304026
  • AND
    • commentRed Hat Enterprise Linux 6 is installed
      ovaloval:com.redhat.rhba:tst:20111656003
    • OR
      • AND
        • commentfreetype-demos is earlier than 0:2.3.11-6.el6_1.6
          ovaloval:com.redhat.rhsa:tst:20111085001
        • commentfreetype-demos is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100864004
      • AND
        • commentfreetype-devel is earlier than 0:2.3.11-6.el6_1.6
          ovaloval:com.redhat.rhsa:tst:20111085003
        • commentfreetype-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100864002
      • AND
        • commentfreetype is earlier than 0:2.3.11-6.el6_1.6
          ovaloval:com.redhat.rhsa:tst:20111085005
        • commentfreetype is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100864006
rhsa
idRHSA-2011:1085
released2011-07-21
severityImportant
titleRHSA-2011:1085: freetype security update (Important)
rpms
  • freetype-0:2.3.11-6.el6_1.6
  • freetype-debuginfo-0:2.3.11-6.el6_1.6
  • freetype-demos-0:2.3.11-6.el6_1.6
  • freetype-devel-0:2.3.11-6.el6_1.6