Debian Security Advisory
DSA-2350-1 freetype -- missing input sanitising
- Date Reported:
- 20 Nov 2011
- Affected Packages:
- freetype
- Vulnerable:
- Yes
- Security database references:
- In the Debian bugtracking system: Bug 649122.
In Mitre's CVE dictionary: CVE-2011-3439. - More information:
-
It was discovered that missing input sanitising in Freetype's processing of CID-keyed fonts could lead to the execution of arbitrary code.
For the oldstable distribution (lenny), this problem has been fixed in version 2.3.7-2+lenny8.
For the stable distribution (squeeze), this problem has been fixed in version 2.4.2-2.1+squeeze3.
For the unstable distribution (sid), this problem has been fixed in version 2.4.8-1.
We recommend that you upgrade your freetype packages.