製品・ソフトウェアに関する情報

JVN脆弱性詳細

FreeType 2 における CFF フォントの処理に脆弱性

タイトル	FreeType 2 における CFF フォントの処理に脆弱性
概要	FreeType 2 には、CFF フォントの処理に脆弱性が存在します。 FreeType は様々な形式のフォントファイルを扱うためのライブラリです。 FreeType 2 には、 CFF フォントの処理において、スタックが破損される脆弱性が存在します。なお、本脆弱性を使用した攻撃活動が確認されています。
想定される影響	細工された CFF フォントを FreeType 2 を使用しているアプリケーションで読み込むことで、遠隔の第三者によって任意のコードを実行される可能性があります。
対策	[アップデートする] 開発者が提供する情報をもとに最新版へアップデートしてください。
公表日	2010年8月9日0:00
登録日	2010年8月30日19:01
最終更新日	2010年11月2日15:24

CVSS2.0 : 危険
スコア	9.3
ベクター	AV:N/AC:M/Au:N/C:C/I:C/A:C

影響を受けるシステム

レッドハット

Red Hat Enterprise Linux 3 (as)

Red Hat Enterprise Linux 3 (es)

Red Hat Enterprise Linux 3 (ws)

Red Hat Enterprise Linux 4 (as)

Red Hat Enterprise Linux 4 (es)

Red Hat Enterprise Linux 4 (ws)

Red Hat Enterprise Linux 4.8 (as)

Red Hat Enterprise Linux 4.8 (es)

Red Hat Enterprise Linux 5 (server)

Red Hat Enterprise Linux Desktop 3.0

Red Hat Enterprise Linux Desktop 4.0

Red Hat Enterprise Linux Desktop 5.0 (client)

RHEL Desktop Workstation 5 (client)

オラクル

OpenSolaris

Oracle Solaris 10

Oracle Solaris 8

Oracle Solaris 9

ターボリナックス

Turbolinux Appliance Server 3.0

Turbolinux Appliance Server 3.0 (x64)

Turbolinux Client 2008

Turbolinux Server 11

Turbolinux Server 11 (x64)

サイバートラスト株式会社

Asianux Server 3 (x86)

Asianux Server 3 (x86-64)

Asianux Server 3.0

Asianux Server 3.0 (x86-64)

Asianux Server 4.0

Asianux Server 4.0 (x86-64)

アップル

iOS 2.0 から 4.0.1 (iPhone 3G 以降の場合)

iOS 2.1 から 4.0 (iPod touch 以降の場合)

iOS 3.2 および 3.2.1 (iPad 用)

iPad

iPhone

iPod touch

FreeType Project

FreeType 2.4.2 より前のバージョン

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-1797	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1797
National Vulnerability Database (NVD)
2	CVE-2010-1797	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1797

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	名前	URL
Apple Security Updates
1	HT4291	http://support.apple.com/kb/HT4291
2	HT4292	http://support.apple.com/kb/HT4292
Apple セキュリティアップデート
3	HT4291	http://support.apple.com/kb/HT4291?viewlocale=ja_JP
4	HT4292	http://support.apple.com/kb/HT4292?viewlocale=ja_JP
Asianux Technical Support Network
5	freetype-2.2.1-26.0.1.AXS3	https://tsn.miraclelinux.com/tsn_local/index.php?m=errata&a=detail&eid=1238
MIRACLE LINUX アップデート情報
6	2109	http://www.miraclelinux.com/support/index.php?q=node/99&errata_id=2109
Red Hat Security Advisory
7	RHSA-2010:0607	https://rhn.redhat.com/errata/RHSA-2010-0607.html
SECURITY BLOG
8	cve_2010_1797_buffer_overflow	http://blogs.sun.com/security/entry/cve_2010_1797_buffer_overflow
The FreeType Project
9	CHANGES BETWEEN 2.4.0 and 2.4.1	http://sourceforge.net/projects/freetype/files/freetype2/2.4.1/NEWS/view
10	CHANGES BETWEEN 2.4.1 and 2.4.2	http://sourceforge.net/projects/freetype/files/freetype2/2.4.2/NEWS/view
11	Stable Releases	http://freetype.sourceforge.net/download.html#stable
12	Top Page	http://freetype.sourceforge.net/index2.html
Turbolinux Security Advisory
13	TLSA-2010-34	http://www.turbolinux.co.jp/security/2010/TLSA-2010-34j.txt

その他

No	名前	URL
JVN
1	JVNVU#275247	http://jvn.jp/cert/JVNVU275247
OPEN SOURCE VULNERABILITY DATABASE (OSVDB)
2	66828	http://osvdb.org/66828
Secunia Advisory
3	SA40807	http://secunia.com/advisories/40807
4	SA40816	http://secunia.com/advisories/40816
SecurityFocus
5	42241	http://www.securityfocus.com/bid/42241
US-CERT Vulnerability Note
6	VU#275247	http://www.kb.cert.org/vuls/id/275247
VUPEN Security
7	VUPEN/ADV-2010-2018	http://www.vupen.com/english/advisories/2010/2018

変更履歴

No	変更内容	変更日
0	[2010年08月30日] 掲載 [2010年10月13日] 影響を受けるシステム：オラクル (cve_2010_1797_buffer_overflow) の情報を追加影響を受けるシステム：ターボリナックス (TLSA-2010-34) の情報を追加ベンダ情報：オラクル (cve_2010_1797_buffer_overflow) を追加ベンダ情報：ターボリナックス (TLSA-2010-34) を追加 [2010年11月02日] 影響を受けるシステム：オラクル (cve_2010_1797_buffer_overflow) の情報を更新	2018年2月17日10:37

NVD脆弱性情報

CVE-2010-1797

概要	Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF Type2 CharStrings interpreter in cff/cffgload.c in FreeType before 2.4.2, as used in Apple iOS before 4.0.2 on the iPhone and iPod touch and before 3.2.2 on the iPad, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted CFF opcodes in embedded fonts in a PDF document, as demonstrated by JailbreakMe. NOTE: some of these details are obtained from third party information.
公表日	2010年8月17日3:39
登録日	2021年1月29日11:01
最終更新日	2024年11月21日10:15

影響を受けるソフトウェアの構成

構成1	以上	以下	より上	未満
cpe:2.3:o:apple:iphone_os:2.0.2:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:3.0:::::::*
cpe:2.3:o:apple:iphone_os:4.0:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:3.2:::::::*
cpe:2.3:o:apple:iphone_os:3.1.3:::::::*
cpe:2.3:o:apple:iphone_os:1.0.2:::::::*
cpe:2.3:o:apple:iphone_os:1.1.2:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:2.2:::::::*
cpe:2.3:o:apple:iphone_os:4.0.1:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:1.1.4:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:1.1.1:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:1.1.1:::::::*
cpe:2.3:o:apple:iphone_os:1.0.1:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:2.0.2:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:3.2:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:2.2:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:2.0.0:::::::*
cpe:2.3:o:apple:iphone_os:3.1.2:::::::*
cpe:2.3:o:apple:iphone_os:3.1.2:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:3.0.1:::::::*
cpe:2.3:o:apple:iphone_os:1.1.3:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:2.1:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:3.1.3:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:1.1.2:::::::*
cpe:2.3:o:apple:iphone_os:3.2.1:-:ipad:::::*
cpe:2.3:o:apple:iphone_os:3.1:::::::*
cpe:2.3:o:apple:iphone_os:1.1.2:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:1.1.3:::::::*
cpe:2.3:o:apple:iphone_os:2.0.1:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:1.1.5:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:1.1.0:::::::*
cpe:2.3:o:apple:iphone_os:2.0.1:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:1.1.4:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:3.1.2:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:3.1:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:3.2:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:1.0.1:::::::*
cpe:2.3:o:apple:iphone_os:3.0.1:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:2.2.1:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:2.1:::::::*
cpe:2.3:o:apple:iphone_os:3.0:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:3.0:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:1.1.5:::::::*
cpe:2.3:o:apple:iphone_os:4.0.1:::::::*
cpe:2.3:o:apple:iphone_os:2.2.1:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:2.0.0:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:1.1.0:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:1.0.2:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:4.0.1:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:4.0:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:2.1.1:::::::*
cpe:2.3:o:apple:iphone_os:1.1.4:::::::*
cpe:2.3:o:apple:iphone_os:2.0.0:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:1.0.0:::::::*
cpe:2.3:o:apple:iphone_os:1.1.0:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:2.0.2:::::::*
cpe:2.3:o:apple:iphone_os:3.1:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:2.0:::::::*
cpe:2.3:o:apple:iphone_os:1.1.5:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:2.0.1:::::::*
cpe:2.3:o:apple:iphone_os:4.0:::::::*
cpe:2.3:o:apple:iphone_os:2.2.1:::::::*
cpe:2.3:o:apple:iphone_os:3.2.1:::::::*
cpe:2.3:o:apple:iphone_os:2.1:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:1.1.3:-:iphone:::::*

関連情報、対策とツール

No	URL	タグ
1	http://freetype.sourceforge.net/index2.html#release-freetype-2.4.2
2	http://freetype.sourceforge.net/index2.html#release-freetype-2.4.2
3	http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=018f5c27813dd7eef4648fe254632ecea0c85a50
4	http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=018f5c27813dd7eef4648fe254632ecea0c85a50
5	http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=11d65e8a1f1f14e56148fd991965424d9bd1cdbc
6	http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=11d65e8a1f1f14e56148fd991965424d9bd1cdbc
7	http://lists.apple.com/archives/security-announce/2010//Aug/msg00000.html
8	http://lists.apple.com/archives/security-announce/2010//Aug/msg00000.html
9	http://lists.apple.com/archives/security-announce/2010//Aug/msg00001.html	Vendor Advisory
10	http://lists.apple.com/archives/security-announce/2010//Aug/msg00001.html	Vendor Advisory
11	http://osvdb.org/66828
12	http://osvdb.org/66828
13	http://secunia.com/advisories/40807	Vendor Advisory
14	http://secunia.com/advisories/40807	Vendor Advisory
15	http://secunia.com/advisories/40816	Vendor Advisory
16	http://secunia.com/advisories/40816	Vendor Advisory
17	http://secunia.com/advisories/40982	Vendor Advisory
18	http://secunia.com/advisories/40982	Vendor Advisory
19	http://secunia.com/advisories/48951
20	http://secunia.com/advisories/48951
21	http://sourceforge.net/projects/freetype/files/freetype2/2.4.2/NEWS/view
22	http://sourceforge.net/projects/freetype/files/freetype2/2.4.2/NEWS/view
23	http://support.apple.com/kb/HT4291	Vendor Advisory
24	http://support.apple.com/kb/HT4291	Vendor Advisory
25	http://support.apple.com/kb/HT4292	Vendor Advisory
26	http://support.apple.com/kb/HT4292	Vendor Advisory
27	http://www.exploit-db.com/exploits/14538	Exploit
28	http://www.exploit-db.com/exploits/14538	Exploit
29	http://www.f-secure.com/weblog/archives/00002002.html
30	http://www.f-secure.com/weblog/archives/00002002.html
31	http://www.securityfocus.com/bid/42151	Exploit
32	http://www.securityfocus.com/bid/42151	Exploit
33	http://www.ubuntu.com/usn/USN-972-1
34	http://www.ubuntu.com/usn/USN-972-1
35	http://www.vupen.com/english/advisories/2010/2018	Vendor Advisory
36	http://www.vupen.com/english/advisories/2010/2018	Vendor Advisory
37	http://www.vupen.com/english/advisories/2010/2106	Vendor Advisory
38	http://www.vupen.com/english/advisories/2010/2106	Vendor Advisory
39	https://bugs.launchpad.net/ubuntu/maverick/+source/freetype/+bug/617019
40	https://bugs.launchpad.net/ubuntu/maverick/+source/freetype/+bug/617019
41	https://bugzilla.redhat.com/show_bug.cgi?id=621144
42	https://bugzilla.redhat.com/show_bug.cgi?id=621144
43	https://exchange.xforce.ibmcloud.com/vulnerabilities/60856
44	https://exchange.xforce.ibmcloud.com/vulnerabilities/60856

共通脆弱性一覧

No	CWE	名前	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

構成1	以上	以下	より上	未満
cpe:2.3:o:apple:iphone_os:2.0.2:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:3.0:::::::*
cpe:2.3:o:apple:iphone_os:4.0:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:3.2:::::::*
cpe:2.3:o:apple:iphone_os:3.1.3:::::::*
cpe:2.3:o:apple:iphone_os:1.0.2:::::::*
cpe:2.3:o:apple:iphone_os:1.1.2:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:2.2:::::::*
cpe:2.3:o:apple:iphone_os:4.0.1:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:1.1.4:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:1.1.1:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:1.1.1:::::::*
cpe:2.3:o:apple:iphone_os:1.0.1:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:2.0.2:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:3.2:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:2.2:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:2.0.0:::::::*
cpe:2.3:o:apple:iphone_os:3.1.2:::::::*
cpe:2.3:o:apple:iphone_os:3.1.2:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:3.0.1:::::::*
cpe:2.3:o:apple:iphone_os:1.1.3:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:2.1:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:3.1.3:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:1.1.2:::::::*
cpe:2.3:o:apple:iphone_os:3.2.1:-:ipad:::::*
cpe:2.3:o:apple:iphone_os:3.1:::::::*
cpe:2.3:o:apple:iphone_os:1.1.2:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:1.1.3:::::::*
cpe:2.3:o:apple:iphone_os:2.0.1:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:1.1.5:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:1.1.0:::::::*
cpe:2.3:o:apple:iphone_os:2.0.1:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:1.1.4:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:3.1.2:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:3.1:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:3.2:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:1.0.1:::::::*
cpe:2.3:o:apple:iphone_os:3.0.1:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:2.2.1:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:2.1:::::::*
cpe:2.3:o:apple:iphone_os:3.0:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:3.0:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:1.1.5:::::::*
cpe:2.3:o:apple:iphone_os:4.0.1:::::::*
cpe:2.3:o:apple:iphone_os:2.2.1:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:2.0.0:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:1.1.0:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:1.0.2:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:4.0.1:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:4.0:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:2.1.1:::::::*
cpe:2.3:o:apple:iphone_os:1.1.4:::::::*
cpe:2.3:o:apple:iphone_os:2.0.0:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:1.0.0:::::::*
cpe:2.3:o:apple:iphone_os:1.1.0:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:2.0.2:::::::*
cpe:2.3:o:apple:iphone_os:3.1:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:2.0:::::::*
cpe:2.3:o:apple:iphone_os:1.1.5:-:iphone:::::*
cpe:2.3:o:apple:iphone_os:2.0.1:::::::*
cpe:2.3:o:apple:iphone_os:4.0:::::::*
cpe:2.3:o:apple:iphone_os:2.2.1:::::::*
cpe:2.3:o:apple:iphone_os:3.2.1:::::::*
cpe:2.3:o:apple:iphone_os:2.1:-:ipodtouch:::::*
cpe:2.3:o:apple:iphone_os:1.1.3:-:iphone:::::*