English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

t1lib Multiple Vulnerabilities


Secunia ID

SA43491

CVE-ID

CVE-2010-2642, CVE-2011-0433, CVE-2011-0764, CVE-2011-1552, CVE-2011-1553, CVE-2011-1554, CVE-2011-5244

Release Date

24 Feb 2011

Last Change

17 Dec 2012

Criticality

Moderately Critical

Solution Status

Unpatched

Software

t1lib 5.x

Where

From remote

Impact
DoS (Denial of Service)

This includes vulnerabilities ranging from excessive resource consumption (e.g. causing a system to use a lot of memory) to crashing an application or an entire system.

System access

This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.

Description

Some vulnerabilities have been reported in t1lib, which can be exploited by malicious people to compromise an application using the library.

1) A boundary error within the "token()" function in lib/t1lib/parseAFM.c can be exploited to cause a heap-based buffer overflow by tricking a user into processing a specially crafted AFM font file in an application using the library.

This is related to vulnerability #3 in:
SA42769

2) A boundary error within the "linetoken()" function in lib/t1lib/parseAFM.c can be exploited to cause a heap-based buffer overflow by tricking a user into processing a specially crafted AFM font file in an application using the library.

This is related to vulnerability #5 in:
SA42769

3) Errors within the "RLineTo()", "RRCurveTo()", and "RMoveTo()" functions (lib/type1/type1.c) can be exploited to e.g. cause a crash or corrupt memory.

The vulnerabilities are reported in version 5.1.2. Other versions may also be affected.

Solution

Do not process untrusted font files in an application using the library.

Reported by

1) Originally reported in Evince by Jon Larimer, IBM X-Force.
2) Originally reported in Evince by rock-madrid.
3) Jonathan Brossard

Original Advisory

Jonathan Brossard:
http://www.toucan-system.com/advisories/tssa-2011-01.txt