Affected: AlmaLinux:8: freetype, AlmaLinux:8: freetype-devel

FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType loads, hints, and renders individual glyphs efficiently.

Security Fix(es):

* FreeType: Buffer overflow in sfnt_init_face (CVE-2022-27404) * FreeType: Segmentation violation via FNT_Size_Request (CVE-2022-27405) * Freetype: Segmentation violation via FT_Request_Size (CVE-2022-27406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Withdrawn by the publisher.

FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request.

FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request.

An attacker with local access to the system could potentially disclose information from protected memory areas via a side-channel attack on the processor cache. Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize. An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. IHISI function 0x17 verifies that the output buffer lies within the command buffer but does not verify that output data does not go beyond the end of the command buffer. In particular, the GetFlashTable function is called directly on the Command Buffer before the DataSize is check, leading to possible circumstances where the data immediately following the command buffer could be destroyed before returning a buffer size error. Using SPI injection, it is possible to modify the FDM contents after it has been measured. This TOCTOU attack could be used to alter data and code used by the remainder of the boot process. Some versions of InsydeH2O use the FreeType tools to embed fonts into the BIOS. InsydeH2O does not use the FreeType API at runtime and usage during build time does not produce a vulnerability in the BIOS. The CVSS reflects this limited usage. In UsbCoreDxe, untrusted input may allow SMRAM or OS memory tampering Use of untrusted pointers could allow OS or SMRAM memory tampering leading to escalation of privileges. This issue was discovered by Insyde during security review. https://www.insyde.com/security-pledge/SA-2022058 In UsbCor…

Affected: openEuler:20.03-LTS-SP1: freetype, openEuler:20.03-LTS-SP3: freetype, openEuler:22.03-LTS: freetype

FreeType is written in C, designed to be small,efficient, highly customizable, and portable while capable of producing high-quality output (glyph images) of most vector and bitmap font formats

Security Fix(es):

FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face.(CVE-2022-27404)

FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request.(CVE-2022-27405)

FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size.(CVE-2022-27406)

libQt5Pdf5-5.15.11-1.1 on GA media

FreeType: Buffer overflow in sfnt_init_face FreeType: Segmentation violation via FNT_Size_Request Freetype: Segmentation violation via FT_Request_Size

Security update for freetype2

Affected: Ubuntu:18.04:LTS: freetype, Ubuntu:20.04:LTS: freetype, Ubuntu:22.04:LTS: freetype

FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request.

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in FreeType ausnutzen, um unbekannte Auswirkungen herbeizuführen.