NVD Vulnerability Detail

CVE-2010-2519

Summary	Heap-based buffer overflow in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted length value in a POST fragment header in a font file.
Publication Date	Aug. 20, 2010, 3 a.m.
Registration Date	Jan. 27, 2021, 12:09 p.m.
Last Update	Nov. 21, 2024, 10:16 a.m.

CVSS2.0 : MEDIUM
Score	6.8
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	低
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:freetype:freetype::::::::					2.4.0

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:9.04:::::::*
cpe:2.3:o:canonical:ubuntu_linux:9.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:8.04::::-:::
cpe:2.3:o:canonical:ubuntu_linux:10.04::::-:::
cpe:2.3:o:canonical:ubuntu_linux:6.06:::::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:apple:mac_os_x::::::::					10.6.5

Configuration4		or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:5.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=5ef20c8c1d4de12a84b50ba497c2a358c90ec44b	Patch Third Party Advisory
2	http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=5ef20c8c1d4de12a84b50ba497c2a358c90ec44b	Patch Third Party Advisory
3	http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=b2ea64bcc6c385a8e8318f9c759450a07df58b6d	Patch Third Party Advisory
4	http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=b2ea64bcc6c385a8e8318f9c759450a07df58b6d	Patch Third Party Advisory
5	http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html	Mailing List Third Party Advisory
6	http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html	Mailing List Third Party Advisory
7	http://lists.nongnu.org/archive/html/freetype/2010-07/msg00001.html	Mailing List Release Notes Third Party Advisory
8	http://lists.nongnu.org/archive/html/freetype/2010-07/msg00001.html	Mailing List Release Notes Third Party Advisory
9	http://marc.info/?l=oss-security&m=127905701201340&w=2	Mailing List Third Party Advisory
10	http://marc.info/?l=oss-security&m=127905701201340&w=2	Mailing List Third Party Advisory
11	http://marc.info/?l=oss-security&m=127909326909362&w=2	Mailing List Third Party Advisory
12	http://marc.info/?l=oss-security&m=127909326909362&w=2	Mailing List Third Party Advisory
13	http://secunia.com/advisories/48951	Third Party Advisory
14	http://secunia.com/advisories/48951	Third Party Advisory
15	http://securitytracker.com/id?1024266	Third Party Advisory VDB Entry
16	http://securitytracker.com/id?1024266	Third Party Advisory VDB Entry
17	http://support.apple.com/kb/HT4435	Broken Link
18	http://support.apple.com/kb/HT4435	Broken Link
19	http://www.debian.org/security/2010/dsa-2070	Third Party Advisory
20	http://www.debian.org/security/2010/dsa-2070	Third Party Advisory
21	http://www.mandriva.com/security/advisories?name=MDVSA-2010:137	Third Party Advisory
22	http://www.mandriva.com/security/advisories?name=MDVSA-2010:137	Third Party Advisory
23	http://www.redhat.com/support/errata/RHSA-2010-0578.html	Third Party Advisory
24	http://www.redhat.com/support/errata/RHSA-2010-0578.html	Third Party Advisory
25	http://www.ubuntu.com/usn/USN-963-1	Third Party Advisory
26	http://www.ubuntu.com/usn/USN-963-1	Third Party Advisory
27	https://bugzilla.redhat.com/show_bug.cgi?id=613194	Issue Tracking Patch Third Party Advisory
28	https://bugzilla.redhat.com/show_bug.cgi?id=613194	Issue Tracking Patch Third Party Advisory
29	https://savannah.nongnu.org/bugs/?30306	Exploit Issue Tracking Third Party Advisory
30	https://savannah.nongnu.org/bugs/?30306	Exploit Issue Tracking Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-787	境界外書き込み	https://cwe.mitre.org/data/definitions/787.html

JVN Vulnerability Information

FreeType の Mac_Read_POST_Resource 関数におけるヒープベースのバッファオーバーフローの脆弱性

Title	FreeType の Mac_Read_POST_Resource 関数におけるヒープベースのバッファオーバーフローの脆弱性
Summary	FreeType の base/ftobjs.c 内にある Mac_Read_POST_Resource 関数には、ヒープベースのバッファオーバーフローの脆弱性が存在します。
Possible impacts	第三者により、フォントファイルの POST フラグメントヘッダーに含まれる巧妙に細工された長さの値を介して、サービス運用妨害 (DoS) 状態にされる、または任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 12, 2010, midnight
Registration Date	Aug. 25, 2010, 5:07 p.m.
Last Update	Dec. 1, 2010, 3:27 p.m.

Affected System

レッドハット

Red Hat Enterprise Linux 4 (as)

Red Hat Enterprise Linux 4 (es)

Red Hat Enterprise Linux 4 (ws)

Red Hat Enterprise Linux 4.8 (as)

Red Hat Enterprise Linux 4.8 (es)

Red Hat Enterprise Linux 5 (server)

Red Hat Enterprise Linux Desktop 4.0

Red Hat Enterprise Linux Desktop 5.0 (client)

RHEL Desktop Workstation 5 (client)

オラクル

OpenSolaris

Oracle Solaris 10

Oracle Solaris 8

Oracle Solaris 9

ターボリナックス

Turbolinux Appliance Server 3.0

Turbolinux Appliance Server 3.0 (x64)

Turbolinux Client 2008

Turbolinux Server 11

Turbolinux Server 11 (x64)

サイバートラスト株式会社

Asianux Server 3 (x86)

Asianux Server 3 (x86-64)

Asianux Server 4.0

Asianux Server 4.0 (x86-64)

アップル

Apple Mac OS X v10.5.8

Apple Mac OS X v10.6 から v10.6.4

Apple Mac OS X Server v10.5.8

Apple Mac OS X Server v10.6 から v10.6.4

FreeType Project

FreeType 2.4.0 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-2519	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2519
National Vulnerability Database (NVD)
2	CVE-2010-2519	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-2519

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
Apple Security Updates
1	HT4435	http://support.apple.com/kb/HT4435
Apple セキュリティアップデート
2	HT4435	http://support.apple.com/kb/HT4435?viewlocale=ja_JP
Asianux Technical Support Network
3	freetype-2.2.1-25.0.1.AXS3	https://tsn.miraclelinux.com/tsn_local/index.php?m=errata&a=detail&eid=1221
MIRACLE LINUX アップデート情報
4	2099	http://www.miraclelinux.com/support/index.php?q=node/99&errata_id=2099
Red Hat Security Advisory
5	RHSA-2010:0578	https://rhn.redhat.com/errata/RHSA-2010-0578.html
SECURITY BLOG
6	cve_2010_1797_buffer_overflow	http://blogs.sun.com/security/entry/cve_2010_1797_buffer_overflow
The FreeType Project
7	CHANGES BETWEEN 2.3.12 and 2.4.0	http://sourceforge.net/projects/freetype/files/freetype2/2.4.0/NEWS/view
8	FreeType 2.4.0 has been released	http://freetype.sourceforge.net/index2.html
Turbolinux Security Advisory
9	TLSA-2010-34	http://www.turbolinux.co.jp/security/2010/TLSA-2010-34j.txt

その他

No	Name	URL
JVN
1	JVNVU#331391	http://jvn.jp/cert/JVNVU331391
Secunia Advisory
2	SA40586	http://secunia.com/advisories/40586
SecurityFocus
3	41663	http://www.securityfocus.com/bid/41663
SecurityTracker
4	1024266	http://securitytracker.com/id?1024266
VUPEN Security
5	VUPEN/ADV-2010-1811	http://www.vupen.com/english/advisories/2010/1811

Change Log

No	Changed Details	Date of change
0	[2010年08月25日] 掲載 [2010年10月19日] 影響を受けるシステム：ターボリナックス (TLSA-2010-34) の情報を追加ベンダ情報：ターボリナックス (TLSA-2010-34) を追加 [2010年12月01日] 影響を受けるシステム：アップル (HT4435) の情報を追加影響を受けるシステム：オラクル (cve_2010_1797_buffer_overflow) の情報を追加ベンダ情報：アップル (HT4435) を追加ベンダ情報：オラクル (cve_2010_1797_buffer_overflow) を追加	Feb. 17, 2018, 10:37 a.m.