DSA-2294-1 freetype -- missing input sanitising

Debian Security Advisory

DSA-2294-1 freetype -- missing input sanitising

Date Reported:

14 Aug 2011

Affected Packages:

freetype

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 635871.
In Mitre's CVE dictionary: CVE-2011-0226.

More information:

It was discovered that insufficient input sanitising in Freetype's code to parse Type1 could lead to the execution of arbitrary code.

For the oldstable distribution (lenny), this problem has been fixed in version 2.3.7-2+lenny6.

For the stable distribution (squeeze), this problem has been fixed in version 2.4.2-2.1+squeeze1.

For the unstable distribution (sid), this problem has been fixed in version 2.4.6-1.

We recommend that you upgrade your freetype packages.