CISA added this vulnerability to their Known Exploited Vulnerabilities Catalog
today, so there will be even more users checking to see if they have it fixed
now:
https://www.cisa.gov/news-events/alerts/2025/05/06/cisa-adds-one-known-exploited-vulnerability-catalog
Hopefully the distros all have patches out already.
-alan-
On 3/12/25 16:10, Douglas Bagnall wrote:
I don't know much about this bug, which seems to have been announced
by Facebook yesterday.
https://nvd.nist.gov/vuln/detail/CVE-2025-27363
An out of bounds write exists in FreeType versions 2.13.0 and below when
attempting to parse font subglyph structures
related to TrueType GX and variable font files. The vulnerable code assigns a
signed short value to an unsigned long
and then adds a static value causing it to wrap around and allocate too small
of a heap buffer. The code then writes
up to 6 signed long integers out of bounds relative to this buffer. This may
result in arbitrary code execution. This
vulnerability may have been exploited in the wild.
The latest version of FreeType is 2.13.3 which is NOT affected, according
to the announcement. Recent distro versions (e.g. Ubuntu 24.04 with 2.13.2)
also look safe.
However, older distro versions seem to have affected libraries. For example
Debian Bookworm has "2.12.1+dfsg-5+deb12u3", which is less than "2.13.0".
The bug would not be too concerning if people only used trusted fonts,
as used to be routine. But webpages now embed fonts, and the affected
"variable font files" format is widely used in browsers. It allows
parametric adjustment of font properties, described here:
https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_fonts/Variable_fonts_guide
However, it looks like the browsers themselves might be embedding
unaffected recent versions of FreeType. For example, I see Mozilla
have a commit with the message:
Bug 1912903 - Update freetype2 to 2.13.3.
https://github.com/mozilla/gecko-dev/commit/026f6a947085020cd189dd9af3da00be433a44f8
I know there's some tension between bundling and unbundling tendencies
in the packaging of browsers, so I am not sure how exposed anyone is.
Anyway, I don't see patches for 2.11.x and 2.12.x in stable/LTS releases,
and the FreeType website seems pretty quiet about this.
Douglas
--
-Alan Coopersmith- alan.coopersm...@oracle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
