Vulnerabilities > CVE-2015-9383 - Out-of-bounds Read vulnerability in multiple products

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
low complexity
freetype
debian
canonical
CWE-125
nessus

Summary

FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.

Vulnerable Configurations

Part Description Count
Application
Freetype
91
OS
Debian
1
OS
Canonical
3

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Overread Buffers
    An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.

Nessus

  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2581.NASL
    descriptionAccording to the versions of the freetype packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a
    last seen2020-05-08
    modified2019-12-19
    plugin id132298
    published2019-12-19
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132298
    titleEulerOS 2.0 SP3 : freetype (EulerOS-SA-2019-2581)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(132298);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/07");
    
      script_cve_id(
        "CVE-2014-9745",
        "CVE-2014-9747",
        "CVE-2015-9381",
        "CVE-2015-9382",
        "CVE-2015-9383"
      );
    
      script_name(english:"EulerOS 2.0 SP3 : freetype (EulerOS-SA-2019-2581)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing multiple security updates.");
      script_set_attribute(attribute:"description", value:
    "According to the versions of the freetype packages installed, the
    EulerOS installation on the remote host is affected by the following
    vulnerabilities :
    
      - The parse_encoding function in type1/t1load.c in
        FreeType before 2.5.3 allows remote attackers to cause
        a denial of service (infinite loop) via a 'broken
        number-with-base' in a Postscript stream, as
        demonstrated by 8#garbage.(CVE-2014-9745)
    
      - The t42_parse_encoding function in type42/t42parse.c in
        FreeType before 2.5.4 does not properly update the
        current position for immediates-only mode, which allows
        remote attackers to cause a denial of service (infinite
        loop) via a Type42 font.(CVE-2014-9747)
    
      - FreeType before 2.6.1 has a heap-based buffer over-read
        in T1_Get_Private_Dict in
        type1/t1parse.c.(CVE-2015-9381)
    
      - FreeType before 2.6.1 has a buffer over-read in
        skip_comment in psaux/psobjs.c because
        ps_parser_skip_PS_token is mishandled in an
        FT_New_Memory_Face operation.(CVE-2015-9382)
    
      - FreeType before 2.6.2 has a heap-based buffer over-read
        in tt_cmap14_validate in sfnt/ttcmap.c.(CVE-2015-9383)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2581
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?649f9ba2");
      script_set_attribute(attribute:"solution", value:
    "Update the affected freetype packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2019/12/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/19");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:freetype");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:freetype-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(3)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
    
    flag = 0;
    
    pkgs = ["freetype-2.4.11-10_1.1.h7",
            "freetype-devel-2.4.11-10_1.1.h7"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"3", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "freetype");
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1491.NASL
    descriptionAccording to the versions of the freetype package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The t42_parse_encoding function in type42/t42parse.c in FreeType before 2.5.4 does not properly update the current position for immediates-only mode, which allows remote attackers to cause a denial of service (infinite loop) via a Type42 font.(CVE-2014-9747) - FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.(CVE-2015-9383) - FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation.(CVE-2015-9382) - FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c.(CVE-2015-9381) - In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new values of cur and limit are sensible before going to Again.(CVE-2015-9290) - The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a
    last seen2020-04-30
    modified2020-04-16
    plugin id135653
    published2020-04-16
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135653
    titleEulerOS Virtualization 3.0.2.2 : freetype (EulerOS-SA-2020-1491)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1224.NASL
    descriptionAccording to the versions of the freetype package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The t42_parse_encoding function in type42/t42parse.c in FreeType before 2.5.4 does not properly update the current position for immediates-only mode, which allows remote attackers to cause a denial of service (infinite loop) via a Type42 font.(CVE-2014-9747) - In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a
    last seen2020-03-19
    modified2020-03-13
    plugin id134513
    published2020-03-13
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134513
    titleEulerOS Virtualization for ARM 64 3.0.2.0 : freetype (EulerOS-SA-2020-1224)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2514.NASL
    descriptionAccording to the versions of the freetype packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a
    last seen2020-05-08
    modified2019-12-04
    plugin id131667
    published2019-12-04
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131667
    titleEulerOS 2.0 SP2 : freetype (EulerOS-SA-2019-2514)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1909.NASL
    descriptionSeveral newly-referenced issues have been fixed in the FreeType 2 font engine. CVE-2015-9381 heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c CVE-2015-9382 buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation CVE-2015-9383 a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c For Debian 8
    last seen2020-06-01
    modified2020-06-02
    plugin id128509
    published2019-09-05
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128509
    titleDebian DLA-1909-1 : freetype security update
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2148.NASL
    descriptionAccording to the versions of the freetype packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The t42_parse_encoding function in type42/t42parse.c in FreeType before 2.5.4 does not properly update the current position for immediates-only mode, which allows remote attackers to cause a denial of service (infinite loop) via a Type42 font.(CVE-2014-9747) - The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a
    last seen2020-05-08
    modified2019-11-12
    plugin id130857
    published2019-11-12
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130857
    titleEulerOS 2.0 SP5 : freetype (EulerOS-SA-2019-2148)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-4126-1.NASL
    descriptionIt was discovered that FreeType incorrectly handled certain font files. An attacker could possibly use this issue to access sensitive information. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id128630
    published2019-09-10
    reporterUbuntu Security Notice (C) 2019 Canonical, Inc. / NASL script (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128630
    titleUbuntu 16.04 LTS : freetype vulnerability (USN-4126-1)