<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<tt>Oracle VM Security Advisory OVMSA-2009-0012<br>
<br>
The following updated rpms for Oracle VM 2.1 have been uploaded to the
Unbreakable Linux Network:<br>
<br>
i386:<br>
freetype-2.2.1-21.el5_3.i386.rpm<br>
<br>
<br>
SRPMS:<br>
<a class="moz-txt-link-freetext"
href="http://oss.oracle.com/oraclevm/server/SRPMS-updates/freetype-2.2.1-21.el5_3.src.rpm">http://oss.oracle.com/oraclevm/server/SRPMS-updates/freetype-2.2.1-21.el5_3.src.rpm</a><br>
<br>
<br>
Description of changes:<br>
</tt>
<pre>Following security fixes is released in this errata:
</pre>
<tt><a linkindex="11"
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0946">CVE-2009-0946</a></tt><br>
<tt>Multiple integer overflows in FreeType 2.3.9 and earlier allow
remote
attackers to execute arbitrary code via vectors related to large
values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c,
and (3) cff/cffload.c.<br>
<br>
<a linkindex="21"
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1806">CVE-2008-1806</a><br>
Integer overflow in FreeType2 before 2.3.6 allows context-dependent
attackers to execute arbitrary code via a crafted set of 16-bit length
values within the Private dictionary table in a Printer Font Binary
(PFB) file, which triggers a heap-based buffer overflow.<br>
<br>
<a linkindex="22"
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1807">CVE-2008-1807</a><br>
FreeType2 before 2.3.6 allow context-dependent attackers to execute
arbitrary code via an invalid "number of axes" field in a Printer Font
Binary (PFB) file, which triggers a free of arbitrary memory
locations, leading to memory corruption.<br>
<br>
<a linkindex="23"
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1808">CVE-2008-1808</a><br>
Multiple off-by-one errors in FreeType2 before 2.3.6 allow
context-dependent attackers to execute arbitrary code via (1) a
crafted table in a Printer Font Binary (PFB) file or (2) a crafted SHC
instruction in a TrueType Font (TTF) file, which triggers a heap-based
buffer overflow.<br>
<br>
</tt><tt>[2.2.1-21]<br>
- Add freetype-2009-CVEs.patch<br>
- Resolves: #496111<br>
<br>
[2.2.1-20]<br>
- Add freetype-2.3.5-CVEs.patch<br>
- Resolves: #450910<br>
<br>
</tt>
</body>
</html>