freetype (SSA:2025-074-01)
freetype (SSA:2025-074-01)
freetype (SSA:2025-074-01)
New freetype packages are available for Slackware 15.0 to fix a security issue.
Here are the details from the Slackware 15.0 ChangeLog:
patches/packages/freetype-2.13.3-i586-1_slack15.0.txz: Upgraded.
This update fixes bugs and a security issue:
An out of bounds write exists in FreeType versions 2.13.0 and below (newer
versions of FreeType are not vulnerable) when attempting to parse font
subglyph structures related to TrueType GX and variable font files. The
vulnerable code assigns a signed short value to an unsigned long and then
adds a static value causing it to wrap around and allocate too small of a
heap buffer. The code then writes up to 6 signed long integers out of bounds
relative to this buffer. This may result in arbitrary code execution.
This vulnerability may have been exploited in the wild.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27363
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab
( http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.
Updated package for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/freetype-2.13.3-i586-1_slack15.0.txz
Updated package for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/freetype-2.13.3-x86_64-1_slack15.0.txz
MD5 signatures:
+-------------+
Slackware 15.0 package:
e5e69552b4e2cf8b8f84e2592596adb7 freetype-2.13.3-i586-1_slack15.0.txz
Slackware x86_64 15.0 package:
ce1672fa23e14303ba3840946410febf freetype-2.13.3-x86_64-1_slack15.0.txz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg freetype-2.13.3-i586-1_slack15.0.txz
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
