--===============6572173114516598919==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature";
 boundary="jy6Sn24JjFx/iggw"
Content-Disposition: inline


--jy6Sn24JjFx/iggw
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

==========================================================================
Ubuntu Security Notice USN-1267-1
November 18, 2011

freetype vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.10
- Ubuntu 10.04 LTS
- Ubuntu 8.04 LTS

Summary:

FreeType could be made to crash or run programs as your login if it
opened a specially crafted font file.

Software Description:
- freetype: FreeType 2 is a font engine library

Details:

It was discovered that FreeType did not correctly handle certain malformed
Type 1 font files. If a user were tricked into using a specially crafted
font file, a remote attacker could cause FreeType to crash or possibly
execute arbitrary code with user privileges. (CVE-2011-3256)

It was discovered that FreeType did not correctly handle certain malformed
CID-keyed PostScript font files. If a user were tricked into using a specially
crafted font file, a remote attacker could cause FreeType to crash or possibly
execute arbitrary code with user privileges. (CVE-2011-3439)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  libfreetype6                    2.4.4-2ubuntu1.1

Ubuntu 11.04:
  libfreetype6                    2.4.4-1ubuntu2.2

Ubuntu 10.10:
  libfreetype6                    2.4.2-2ubuntu0.3

Ubuntu 10.04 LTS:
  libfreetype6                    2.3.11-1ubuntu2.5

Ubuntu 8.04 LTS:
  libfreetype6                    2.3.5-1ubuntu4.8.04.7

After a standard system update you need to restart your session to make
all the necessary changes.

References:
  http://www.ubuntu.com/usn/usn-1267-1
  CVE-2011-3256, CVE-2011-3439

Package Information:
  https://launchpad.net/ubuntu/+source/freetype/2.4.4-2ubuntu1.1
  https://launchpad.net/ubuntu/+source/freetype/2.4.4-1ubuntu2.2
  https://launchpad.net/ubuntu/+source/freetype/2.4.2-2ubuntu0.3
  https://launchpad.net/ubuntu/+source/freetype/2.3.11-1ubuntu2.5
  https://launchpad.net/ubuntu/+source/freetype/2.3.5-1ubuntu4.8.04.7


--jy6Sn24JjFx/iggw
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBCgAGBQJOxeS6AAoJENaSAD2qAscK37YP/AjFmnMLRL93pT92TPrPKePY
gmPXh+KkATFWrt+BJmVCco+uJbAV2TRlUUZX+6hLKSWGIvrwN7l8UhEQc4NpkCtt
CFTuWb5PuCNO9aJh0WKYDIzNZjqSPKOMMsoS/HrgMbrDGBlNdCwaz24oxCII141F
Vffc/mjVy5iaAGYvdBArE4i4v5GPD3tcpoZ1mKkDUYEaGN7TdJf6viIBzUJk8xkM
qt2qj7mdT/7kFk3giPX8+oyQ5JpaMdidHDb0+JrTaFpWk161csQhplIvzXIv2AJb
nT3XDT8RZBga/t3GkrPSnc929bOqNSgXzmyiIsya2YOKxobgcFOOqkEEwzCGn2c0
sTwEwY9xOIR71syghxT/TcG/iWh/O3Ux0QBDuG6C+6vSEpqgfSDDnp1RhHpeqcv1
uSPDO+Oz399Dt8p7302+VE6+VAmCEzdukcwcrEAa7lBW9GkjA1hWGWEqRynWVsrk
1m3M/sgxgrjAfdTwLa5slCk27B/vdxmA4dsEk8eYhmhp6XPsDxE2aBlsvGAAAG2+
Tbk/7RYlD4XkkoYbaD18dQeQsf+4dd+XLjnImTG5tlknjuFN+gB93d97eEfde+pf
Yn7AWFKmbrZ/x4JCiN4iTuTrBYT3UgGkH7fBTJtIcJKIxN/1eEOIcyZvXfJRjlCh
tc8tHgbRKptGhToM03/t
=LEWH
-----END PGP SIGNATURE-----

--jy6Sn24JjFx/iggw--


--===============6572173114516598919==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

--===============6572173114516598919==--