freetype: Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2019.3358
              A vulnerability has been identified in freetype
                             5 September 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           freetype
Publisher:         Debian
Operating System:  Debian GNU/Linux 8
                   Windows
                   UNIX variants (UNIX, Linux, OSX)
Impact/Access:     Denial of Service        -- Remote with User Interaction
                   Access Confidential Data -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2015-9383 CVE-2015-9382 CVE-2015-9381

Original Bulletin: 
   https://security-tracker.debian.org/tracker/DLA-1909-1

Comment: This advisory references vulnerabilities in products which run on 
         platforms other than Debian. It is recommended that administrators 
         running freetype check for an updated version of the software for 
         their operating system.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Package        : freetype
Version        : 2.5.2-3+deb8u4
CVE ID         : CVE-2015-9381 CVE-2015-9382 CVE-2015-9383


Several newly-referenced issues have been fixed in the FreeType 2 font
engine.

CVE-2015-9381

  heap-based buffer over-read in T1_Get_Private_Dict in
  type1/t1parse.c

CVE-2015-9382

  buffer over-read in skip_comment in psaux/psobjs.c because
  ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face
  operation

CVE-2015-9383

  a heap-based buffer over-read in tt_cmap14_validate in
  sfnt/ttcmap.c

For Debian 8 "Jessie", these problems have been fixed in version
2.5.2-3+deb8u4.

We recommend that you upgrade your freetype packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEEQic8GuN/xDR88HkSj/HLbo2JBZ8FAl1vsDIACgkQj/HLbo2J
BZ99vwf/dhn8Cc2ypa3wHUPHzs5vk6Y1RLQexTgWloSxpG9yVZyrjOVKE4VKNAEz
MDg4B27vmW7aMvILHGgP5HQ5gnUQVkveKtU2vHQMB1ZPHbWDLBT88niQ0HQP8Yct
F/dCK88x6+/32I+O8H+irEZXj94wbK023AvKUHXHjkX7cHh9Xbn2y9TT9iQxnwrD
pjENycIp63Kfayk+iMHZaDoZfsyIGB3DZbEnoDICQWgzt+bCxcLkBSPbLgrF2o0j
zTpY2h8f6reMGEW/hEUxyh+yJEE8jjd7go04EZmjhCWArav6tPt0ByrSFfYIMkbF
mDWOhZ64MrQyP6op+/+0DGE0uNYN3g==
=MSV8
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXXBUpWaOgq3Tt24GAQjUgRAArHM3Q9iyFqij+aipSWMUeW+QuIGYsKGy
bxJOeqn0rXFvGwx0yefUh49ehhQzbd1vSMicfPNOi/fQgwyOeGeyRDGiZ+dXQi3F
Pie02mzbhywnKia9UmantG4h3a84KjK0Ufvq44f6+1sLDChp8ZQQ0o/i1Rx2woge
JUtUPyjRLHzrcHDio6DdGx5bPKugPaPwCbGW174wfascT/U6A2PvMkJlObOvZ3F4
qf0NwRAJqFq8bHJ7bhxgBFC+wEtWp65HuevhySNWGkN3CEGzFoa156rkxr/ZdqW5
uJ7gEftSW0jUt4VDHTICFY9YwXuxm9UuhqbiHTIpweNIw7ptGxhIod7PasyTSkpI
0CE6qsSnQ20KKGjUWHARZeRW3qFz5Rxa8Y3TGkq3mgm7sFonWiyCWZCULgZW5hAw
pADa4yYD7xW8BNc5xMLkfdL1VQMINHBqm+Jgr8IsCkgO7LUefogXA+DHVDR1upJY
GPBnOpGJb8OJcUncRIIAitUSQcPstaiv/5vseEWJXKLbSojZ/hO6O6xSBjZDc1qR
PIHgDjBr5f22Pi/Ysfpit2F70DYrUg5+ORKJEUIh/SgSEry66/unc6MICfm4vbrU
1F8KagYCYy8ysi/XRjNvwqdE5AQjE5yeUq0qs9k6QcDTtVPJceHETLczIJ9NLdmt
KIjU09jV6QA=
=X4TR
-----END PGP SIGNATURE-----