graphite2 security update

CentOS Errata and Security Advisory CESA-2016:0594

Graphite2 is a project within SIL’s Non-Roman Script Initiative and Language Software Development groups to provide rendering capabilities for complex non-Roman writing systems. Graphite can be used to create “smart fonts” capable of displaying writing systems with various complex behaviors. With respect to the Text Encoding Model, Graphite handles the “Rendering” aspect of writing system implementation.

The following packages have been upgraded to a newer upstream version: graphite2 (1.3.6).

Security Fix(es):

• Various vulnerabilities have been discovered in Graphite2. An attacker able to trick an unsuspecting user into opening specially crafted font files in an application using Graphite2 could exploit these flaws to cause the application to crash or, potentially, execute arbitrary code with the privileges of the application. (CVE-2016-1521, CVE-2016-1522, CVE-2016-1523, CVE-2016-1526)

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2016-April/083973.html

Affected packages:
graphite2
graphite2-devel

Upstream details at:
https://access.redhat.com/errata/RHSA-2016:0594