Explain CVE-2011-0226
Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Type 1 font in a PDF document, as exploited in the wild in July 2011.
Affected Products: n/a
References: [{'name': '45224', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/45224'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT4803'}, {'name': 'APPLE-SA-2011-07-15-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2011//Jul/msg00000.html'}, {'name': 'openSUSE-SU-2011:0852', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00015.html'}, {'name': '48619', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/48619'}, {'name': '[freetype-devel] 20110709 Re: details on iPhone exploit caused by FreeType?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.nongnu.org/archive/html/freetype-devel/2011-07/msg00020.html'}, {'name': 'APPLE-SA-2011-07-15-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2011//Jul/msg00001.html'}, {'name': '45167', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/45167'}, {'name': 'APPLE-SA-2011-10-12-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html'}, {'name': 'RHSA-2011:1085', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2011-1085.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT4802'}, {'name': '[freetype-devel] 20110708 Re: details on iPhone exploit caused by FreeType?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.nongnu.org/archive/html/freetype-devel/2011-07/msg00015.html'}, {'name': 'SUSE-SU-2011:0853', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00016.html'}, {'name': '[freetype-devel] 20110711 Re: details on iPhone exploit caused by FreeType?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.nongnu.org/archive/html/freetype-devel/2011-07/msg00028.html'}, {'name': 'DSA-2294', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2011/dsa-2294'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5002'}, {'name': 'MDVSA-2011:120', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2011:120'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.appleinsider.com/articles/11/07/06/hackers_release_new_browser_based_ios_jailbreak_based_on_pdf_exploit.html'}, {'name': '[freetype-devel] 20110708 details on iPhone exploit caused by FreeType?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.nongnu.org/archive/html/freetype-devel/2011-07/msg00014.html'}, {'name': '[freetype-devel] 20110711 Re: details on iPhone exploit caused by FreeType?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.nongnu.org/archive/html/freetype-devel/2011-07/msg00026.html'}]
CVE State: PUBLISHED