CVE-2012-1133

Published: 7 March 2012

FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via crafted glyph or bitmap data in a BDF font.

Status

Notes

Reproducer does not trigger in hardy-oneiric, but code is present
See Red Hat Bugzilla comment #8 for a great analysis
Patching hardy-oneiric in case the regression fix, which would expose
this vulnerability, is ever backported

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1133
• https://ubuntu.com/security/notices/USN-1403-1
• NVD
• Launchpad
• Debian

Bugs

• https://savannah.nongnu.org/bugs/?35607
• https://bugzilla.redhat.com/show_bug.cgi?id=800591