[Secure-testing-team] Bug#861220: freetype: CVE-2017-8105

[Salvatore Bonaccorso]

Source: freetype
Version: 2.5.2-3
Severity: important
Tags: upstream patch security

Hi,

the following vulnerability was published for freetype.

CVE-2017-8105[0]:
| FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a
| heap-based buffer overflow related to the t1_decoder_parse_charstrings
| function in psaux/t1decode.c.

It is fixed by the upstream commit [1].

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-8105
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8105
[1] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=f958c48ee431bef8d4d466b40c9cb2d4dbcb7791

Regards,
Salvatore