Security Bulletin: IBM Flex System Manager (FSM) is affected by multiple freetype2 vulnerabilities

Summary

Multiple security vulnerabilities have been discovered in freetype2 that is embedded in the IBM FSM. This bulletin addresses these vulnerabilities.

Vulnerability Details

CVEID: CVE-2014-9656**
DESCRIPTION:** FreeType is vulnerable to a denial of service, caused by an integer overflow in the tt_sbit_decoder_load_image function. A remote attacker could exploit this vulnerability using specially-crafted OpenType font to cause a denial of service.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100796 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9657**
DESCRIPTION:** FreeType is vulnerable to a denial of service, caused by an out-of-bounds read in the tt_face_load_hdmx function. A remote attacker could exploit this vulnerability using specially-crafted TrueType font to cause a denial of service.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100797 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9658**
DESCRIPTION:** FreeType is vulnerable to a denial of service, caused by an error in the tt_face_load_kern function. A remote attacker could exploit this vulnerability using specially-crafted TrueType font to cause a denial of service.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100798 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9659**
DESCRIPTION:** FreeType is vulnerable to a stack buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer using specially-crafted OpenType font and execute arbitrary code on the system or cause a denial of service.
CVSS Base Score: 6.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100799 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVEID: CVE-2014-9660**
DESCRIPTION:** FreeType is vulnerable to a denial of service, caused by a NULL pointer dereference in the _bdf_parse_glyphs function. A remote attacker could exploit this vulnerability using specially-crafted BDF font to cause a denial of service.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100800 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9661**
DESCRIPTION:** FreeType is vulnerable to a denial of service, caused by an use-after-free error in type42/t42parse.c. A remote attacker could exploit this vulnerability using specially-crafted Type42 font to cause a denial of service.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100801 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9662**
DESCRIPTION:** FreeType is vulnerable to a denial of service, caused by a heap-based buffer overflow in cff/cf2ft.c. A remote attacker could exploit this vulnerability using specially-crafted OTF font to cause a denial of service.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100823 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9663**
DESCRIPTION:** FreeType is vulnerable to a denial of service, caused by an out-of-bounds read in the tt_cmap4_validate function. A remote attacker could exploit this vulnerability using specially-crafted cmap SFNT table to cause the a denial of service.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100822 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9664**
DESCRIPTION:** FreeType is vulnerable to a denial of service, caused by a parsing error in type42/t42parse.c and type1/t1load.c . A remote attacker could exploit this vulnerability using specially-crafted Type42 font to cause a denial of service.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100830 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9665**
DESCRIPTION:** FreeType is vulnerable to a denial of service, caused by an integer overflow and the heap-based buffer overflow in the Load_SBit_Png function. A remote attacker could exploit this vulnerability using specially-crafted font files to cause a denial of service
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100805 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9666**
DESCRIPTION:** FreeType is vulnerable to a denial of service, caused by an integer overflow and out-of-bounds read in the tt_sbit_decoder_init function. A remote attacker could exploit this vulnerability using specially-crafted embedded bitmap to cause a denial of service.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100804 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9667**
DESCRIPTION:** FreeType is vulnerable to a denial of service, caused by an integer overflow and out-of-bounds read in sfnt/ttload.c. A remote attacker could exploit this vulnerability using specially-crafted SFNT table to cause a denial of service.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100803 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9668**
DESCRIPTION:** FreeType is vulnerable to a denial of service, caused by an integer overflow and heap-based buffer overflow in the woff_open_font function. A remote attacker could exploit this vulnerability using a specially-crafted WOFF file to cause a denial of service.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100802 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9669**
DESCRIPTION:** FreeType is vulnerable to a denial of service, caused by multiple integer overflows in sfnt/ttcmap.c. A remote attacker could exploit this vulnerability using specially-crafted cmap SFNT table to cause a denial of service.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100824 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9670**
DESCRIPTION:** FreeType is vulnerable to a denial of service, caused by multiple integer signedness errors in the pcf_get_encodings function. A remote attacker could exploit this vulnerability using specially-crafted PCF files to cause a denial of service.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100825 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9671**
DESCRIPTION:** FreeType is vulnerable to a denial of service, caused by an off-by-one error in the pcf_get_properties function. A remote attacker could exploit this vulnerability using specially-crafted PCF files to cause a denial of service.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100826 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9672**
DESCRIPTION:** FreeType is vulnerable to a denial of service, caused by an array index error in the parse_fond function. A remote attacker could exploit this vulnerability using specially-crafted FOND resource to cause a denial of service.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100827 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9673**
DESCRIPTION:** FreeType is vulnerable to a denial of service, caused by an integer signedness error in the Mac_Read_POST_Resource function. A remote attacker could exploit this vulnerability using specially-crafted Mac font to cause a denial of service.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100828 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9674**
DESCRIPTION:** FreeType is vulnerable to a denial of service, caused by an integer overflow and heap-based buffer overflow in the Mac_Read_POST_Resource function. A remote attacker could exploit this vulnerability using specially-crafted Mac font to cause a denial of service.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100829 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-9675**
DESCRIPTION:** FreeType could allow a remote attacker to bypass security restrictions, caused by an error in bdf/bdflib.c. An attacker could exploit this vulnerability using specially-crafted font file to bypass ASLR features.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100821 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVEID: CVE-2014-9745**
DESCRIPTION:** FreeType is vulnerable to a denial of service, caused by improper validation in parse_encode() function in 'src/type1/t1load.c. By using a specially-crafted FreeType font, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 3.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/106351 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L)

CVEID: CVE-2014-9747**
DESCRIPTION:** FreeType is vulnerable to denial of service, caused by the failure to properly update the current position for immediates-only mode by the t42_parse_encoding function in type42/t42parse.c. An attacker could exploit this vulnerability using a Type42 font to cause the application to enter into an infinite loop.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114236 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Flex System Manager 1.3.4.x
Flex System Manager 1.3.3.x
Flex System Manager 1.3.2.x

Remediation/Fixes

IBM recommends updating the FSM using the instructions referenced in this table.

Product |

VRMF |

APAR |

Remediation
—|—|—|—
Flex System Manager|

1.3.4.x |

IT16218

| Install fsmfix1.3.4.0_IT16216_IT16217_IT16218_IT16219
Flex System Manager|

1.3.3.x |

IT16218

| Install fsmfix1.3.3.0_IT16216_IT16217_IT16218_IT16219
Flex System Manager|

1.3.2.x |

IT16218

| Install fsmfix1.3.2.0_IT16216_IT16217_IT16218_IT16219

For 1.1.x.x, 1.2.x.x, 1.3.0.x and 1.3.1.x IBM recommends upgrading to a fixed, supported version/release of the product.

Workarounds and Mitigations

None