Vulnerabilities > CVE-2014-9747 - Resource Management Errors vulnerability in multiple products

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
freetype
debian
CWE-399
nessus

Summary

The t42_parse_encoding function in type42/t42parse.c in FreeType before 2.5.4 does not properly update the current position for immediates-only mode, which allows remote attackers to cause a denial of service (infinite loop) via a Type42 font.

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2581.NASL
    descriptionAccording to the versions of the freetype packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a
    last seen2020-05-08
    modified2019-12-19
    plugin id132298
    published2019-12-19
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132298
    titleEulerOS 2.0 SP3 : freetype (EulerOS-SA-2019-2581)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(132298);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/07");
    
      script_cve_id(
        "CVE-2014-9745",
        "CVE-2014-9747",
        "CVE-2015-9381",
        "CVE-2015-9382",
        "CVE-2015-9383"
      );
    
      script_name(english:"EulerOS 2.0 SP3 : freetype (EulerOS-SA-2019-2581)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing multiple security updates.");
      script_set_attribute(attribute:"description", value:
    "According to the versions of the freetype packages installed, the
    EulerOS installation on the remote host is affected by the following
    vulnerabilities :
    
      - The parse_encoding function in type1/t1load.c in
        FreeType before 2.5.3 allows remote attackers to cause
        a denial of service (infinite loop) via a 'broken
        number-with-base' in a Postscript stream, as
        demonstrated by 8#garbage.(CVE-2014-9745)
    
      - The t42_parse_encoding function in type42/t42parse.c in
        FreeType before 2.5.4 does not properly update the
        current position for immediates-only mode, which allows
        remote attackers to cause a denial of service (infinite
        loop) via a Type42 font.(CVE-2014-9747)
    
      - FreeType before 2.6.1 has a heap-based buffer over-read
        in T1_Get_Private_Dict in
        type1/t1parse.c.(CVE-2015-9381)
    
      - FreeType before 2.6.1 has a buffer over-read in
        skip_comment in psaux/psobjs.c because
        ps_parser_skip_PS_token is mishandled in an
        FT_New_Memory_Face operation.(CVE-2015-9382)
    
      - FreeType before 2.6.2 has a heap-based buffer over-read
        in tt_cmap14_validate in sfnt/ttcmap.c.(CVE-2015-9383)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2581
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?649f9ba2");
      script_set_attribute(attribute:"solution", value:
    "Update the affected freetype packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2019/12/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/19");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:freetype");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:freetype-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(3)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
    
    flag = 0;
    
    pkgs = ["freetype-2.4.11-10_1.1.h7",
            "freetype-devel-2.4.11-10_1.1.h7"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"3", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "freetype");
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1491.NASL
    descriptionAccording to the versions of the freetype package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The t42_parse_encoding function in type42/t42parse.c in FreeType before 2.5.4 does not properly update the current position for immediates-only mode, which allows remote attackers to cause a denial of service (infinite loop) via a Type42 font.(CVE-2014-9747) - FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.(CVE-2015-9383) - FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation.(CVE-2015-9382) - FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c.(CVE-2015-9381) - In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new values of cur and limit are sensible before going to Again.(CVE-2015-9290) - The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a
    last seen2020-04-30
    modified2020-04-16
    plugin id135653
    published2020-04-16
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135653
    titleEulerOS Virtualization 3.0.2.2 : freetype (EulerOS-SA-2020-1491)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1224.NASL
    descriptionAccording to the versions of the freetype package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The t42_parse_encoding function in type42/t42parse.c in FreeType before 2.5.4 does not properly update the current position for immediates-only mode, which allows remote attackers to cause a denial of service (infinite loop) via a Type42 font.(CVE-2014-9747) - In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a
    last seen2020-03-19
    modified2020-03-13
    plugin id134513
    published2020-03-13
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134513
    titleEulerOS Virtualization for ARM 64 3.0.2.0 : freetype (EulerOS-SA-2020-1224)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-319.NASL
    descriptionSergey Gorbaty reported issues related to the FreeType font engine. FreeType improperly handled certain malformed font files, allowing remote attackers to cause a Denial of Service when specially crafted font files were used. For Debian 6
    last seen2020-03-17
    modified2015-10-01
    plugin id86211
    published2015-10-01
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86211
    titleDebian DLA-319-1 : freetype security update
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3370.NASL
    descriptionIt was discovered that FreeType did not properly handle some malformed inputs. This could allow remote attackers to cause a denial of service (crash) via crafted font files.
    last seen2020-06-01
    modified2020-06-02
    plugin id86304
    published2015-10-07
    reporterThis script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86304
    titleDebian DSA-3370-1 : freetype - security update
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-1149-1.NASL
    descriptionThis update of the freetype2 library fixes two security issues : - An infinite loop in parse_encoding in t1load.c (CVE-2014-9745, bsc#945849) - Use of uninitialized memory in ps_parser_load_field, t42_parse_font_matrix and t1_parse_font_matrix (CVE-2014-9747, bsc#947966) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id90758
    published2016-04-27
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90758
    titleSUSE SLES11 Security Update : freetype2 (SUSE-SU-2016:1149-1)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2514.NASL
    descriptionAccording to the versions of the freetype packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a
    last seen2020-05-08
    modified2019-12-04
    plugin id131667
    published2019-12-04
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131667
    titleEulerOS 2.0 SP2 : freetype (EulerOS-SA-2019-2514)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2015-639.NASL
    descriptionThis update of the freetype2 library fixes two security issues. These security issues were fixed : - CVE-2014-9745: Infinite loop in parse_encoding in t1load.c (bsc#945849) - CVE-2014-9747: Use of uninitialized memory in ps_parser_load_field, t42_parse_font_matrix and t1_parse_font_matrix (bsc#947966)
    last seen2020-06-05
    modified2015-10-12
    plugin id86336
    published2015-10-12
    reporterThis script is Copyright (C) 2015-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/86336
    titleopenSUSE Security Update : freetype2 (openSUSE-2015-639)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2148.NASL
    descriptionAccording to the versions of the freetype packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The t42_parse_encoding function in type42/t42parse.c in FreeType before 2.5.4 does not properly update the current position for immediates-only mode, which allows remote attackers to cause a denial of service (infinite loop) via a Type42 font.(CVE-2014-9747) - The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a
    last seen2020-05-08
    modified2019-11-12
    plugin id130857
    published2019-11-12
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130857
    titleEulerOS 2.0 SP5 : freetype (EulerOS-SA-2019-2148)