SUSE-SU-2019:2236-1: moderate: Security update for fontforge

sle-updates at sle-updates at
Wed Aug 28 07:18:38 MDT 2019

   SUSE Security Update: Security update for fontforge

Announcement ID:    SUSE-SU-2019:2236-1
Rating:             moderate
References:         #1050161 #1050181 #1050185 #1050187 #1050193 
                    #1050194 #1050195 #1050196 #1050200 
Cross-References:   CVE-2017-11568 CVE-2017-11569 CVE-2017-11571
                    CVE-2017-11572 CVE-2017-11573 CVE-2017-11574
                    CVE-2017-11575 CVE-2017-11576 CVE-2017-11577
Affected Products:
                    SUSE Linux Enterprise Software Development Kit 12-SP4

   An update that fixes 9 vulnerabilities is now available.


   This update for fontforge fixes the following security issues:

   fontforge was updated to 20170731, fixings lots of bugs and security

   - CVE-2017-11568: Heap-based buffer over-read in PSCharStringToSplines
   - CVE-2017-11569: Heap-based buffer over-read in readttfcopyrights
   - CVE-2017-11571: Stack-based buffer overflow in addnibble (bsc#1050185)
   - CVE-2017-11572: Heap-based buffer over-read in readcfftopdicts
   - CVE-2017-11573: Over-read in ValidatePostScriptFontName (bsc#1050193)
   - CVE-2017-11574: Heap-based buffer overflow in readcffset (bsc#1050194)
   - CVE-2017-11575: Buffer over-read in strnmatch (bsc#1050195)
   - CVE-2017-11576: Ensure a positive size in a weight vector memcpycall in
     readcfftopdict (bsc#1050196)
   - CVE-2017-11577: Buffer over-read in getsid (bsc#1050200)

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Software Development Kit 12-SP4:

      zypper in -t patch SUSE-SLE-SDK-12-SP4-2019-2236=1

Package List:

   - SUSE Linux Enterprise Software Development Kit 12-SP4 (aarch64 ppc64le s390x x86_64):



More information about the sle-updates mailing list