SUSE-SU-2019:2236-1: moderate: Security update for fontforge

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for fontforge
______________________________________________________________________________

Announcement ID:    SUSE-SU-2019:2236-1
Rating:             moderate
References:         #1050161 #1050181 #1050185 #1050187 #1050193 
                    #1050194 #1050195 #1050196 #1050200 
Cross-References:   CVE-2017-11568 CVE-2017-11569 CVE-2017-11571
                    CVE-2017-11572 CVE-2017-11573 CVE-2017-11574
                    CVE-2017-11575 CVE-2017-11576 CVE-2017-11577
                   
Affected Products:
                    SUSE Linux Enterprise Software Development Kit 12-SP4
______________________________________________________________________________

   An update that fixes 9 vulnerabilities is now available.

Description:

   This update for fontforge fixes the following security issues:

   fontforge was updated to 20170731, fixings lots of bugs and security
   issues.

   - CVE-2017-11568: Heap-based buffer over-read in PSCharStringToSplines
     (bsc#1050161)
   - CVE-2017-11569: Heap-based buffer over-read in readttfcopyrights
     (bsc#1050181)
   - CVE-2017-11571: Stack-based buffer overflow in addnibble (bsc#1050185)
   - CVE-2017-11572: Heap-based buffer over-read in readcfftopdicts
     (bsc#1050187)
   - CVE-2017-11573: Over-read in ValidatePostScriptFontName (bsc#1050193)
   - CVE-2017-11574: Heap-based buffer overflow in readcffset (bsc#1050194)
   - CVE-2017-11575: Buffer over-read in strnmatch (bsc#1050195)
   - CVE-2017-11576: Ensure a positive size in a weight vector memcpycall in
     readcfftopdict (bsc#1050196)
   - CVE-2017-11577: Buffer over-read in getsid (bsc#1050200)


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Software Development Kit 12-SP4:

      zypper in -t patch SUSE-SLE-SDK-12-SP4-2019-2236=1



Package List:

   - SUSE Linux Enterprise Software Development Kit 12-SP4 (aarch64 ppc64le s390x x86_64):

      fontforge-20170731-11.8.1
      fontforge-debuginfo-20170731-11.8.1
      fontforge-debugsource-20170731-11.8.1


References:

   https://www.suse.com/security/cve/CVE-2017-11568.html
   https://www.suse.com/security/cve/CVE-2017-11569.html
   https://www.suse.com/security/cve/CVE-2017-11571.html
   https://www.suse.com/security/cve/CVE-2017-11572.html
   https://www.suse.com/security/cve/CVE-2017-11573.html
   https://www.suse.com/security/cve/CVE-2017-11574.html
   https://www.suse.com/security/cve/CVE-2017-11575.html
   https://www.suse.com/security/cve/CVE-2017-11576.html
   https://www.suse.com/security/cve/CVE-2017-11577.html
   https://bugzilla.suse.com/1050161
   https://bugzilla.suse.com/1050181
   https://bugzilla.suse.com/1050185
   https://bugzilla.suse.com/1050187
   https://bugzilla.suse.com/1050193
   https://bugzilla.suse.com/1050194
   https://bugzilla.suse.com/1050195
   https://bugzilla.suse.com/1050196
   https://bugzilla.suse.com/1050200