Home > Security > Advisories

Advisories

Mandriva Advisories

Package name freetype2
Date April 10th, 2007
Advisory ID MDKSA-2007:081-1
Affected versions 2007.1
Synopsis Updated freetype2 packages fix vulnerability

Problem Description

iDefense integer overflows in the way freetype handled various font
files. A malicious local user could exploit these issues to potentially
execute arbitrary code.

Updated packages have been patched to correct this issue.

Update:

Packages for Mandriva Linux 2007.1 are now available.

Updated Packages

Mandriva Linux 2007.1

 b6d65fcc62754bd1400e90efa49e6679  2007.1/i586/libfreetype6-2.3.1-3.1mdv2007.1.i586.rpm
 142d11543d5db9880c9db97b99595559  2007.1/i586/libfreetype6-devel-2.3.1-3.1mdv2007.1.i586.rpm
 bfc535d187f868751ed2460f3de01e53  2007.1/i586/libfreetype6-static-devel-2.3.1-3.1mdv2007.1.i586.rpm 
 81a51e662770f7d91ff92b6ae53211af  2007.1/SRPMS/freetype2-2.3.1-3.1mdv2007.1.src.rpm

Mandriva Linux 2007.1/X86_64

 3323e12c0ac539c7bc6b7f6ead647f7e  2007.1/x86_64/lib64freetype6-2.3.1-3.1mdv2007.1.x86_64.rpm
 c9c6db8da9895b96eb074ffb09f2383e  2007.1/x86_64/lib64freetype6-devel-2.3.1-3.1mdv2007.1.x86_64.rpm
 87f48e86ee449bbba06fd0159c6c34af  2007.1/x86_64/lib64freetype6-static-devel-2.3.1-3.1mdv2007.1.x86_64.rpm 
 81a51e662770f7d91ff92b6ae53211af  2007.1/SRPMS/freetype2-2.3.1-3.1mdv2007.1.src.rpm

References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1351

Upgrade

To upgrade automatically, use MandrivaUpdate.


Verification

Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :

                rpm --checksig package.rpm

You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.

If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.