Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:freetype User: [email protected] Usertags: pu
[ Reason ] CVE-2026-95512: Prevent denial of service via repeated subroutine allocations in the CID font loader. Crafted CID fonts can trigger repeated subroutine allocations and decryptions across many font dictionaries during face loading, causing severe memory and CPU exhaustion. [ Impact ] A remote attacker could exploit a vulnerability in FreeType's CID font loader by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate. [ Tests ] Manual testing. [ Risks ] The patch was developed by an upstream FreeType developer and verified by another. [ Checklist ] [X] *all* changes are documented in the d/changelog [X] I reviewed all changes and I approve them [X] attach debdiff against the package in (old)stable [X] the issue is verified as fixed in unstable [ Changes ] This upload adds an upstream patch to fix CVE-2026-95512. It is the same patch applied to Sid and Forky. [ Other info ] Debian Security Team advised no DSA with my agreement.
diff -Nru freetype-2.13.3+dfsg/debian/changelog freetype-2.13.3+dfsg/debian/changelog --- freetype-2.13.3+dfsg/debian/changelog 2026-03-18 07:21:54.000000000 +1100 +++ freetype-2.13.3+dfsg/debian/changelog 2026-10-11 21:53:20.000000000 +1100 @@ -1,3 +1,9 @@ +freetype (2.13.3+dfsg-1+deb13u2) trixie; urgency=medium + + * debian/patches: Fix CVE-2026-95512 (Closes: #1149953). + + -- Hugh McMaster <[email protected]> Sun, 11 Oct 2026 21:53:20 +1100 + freetype (2.13.3+dfsg-1+deb13u1) trixie-security; urgency=medium * CVE-2026-23865 (Closes: #1129606) diff -Nru freetype-2.13.3+dfsg/debian/patches/CVE-2026-95512.patch freetype-2.13.3+dfsg/debian/patches/CVE-2026-95512.patch --- freetype-2.13.3+dfsg/debian/patches/CVE-2026-95512.patch 1970-01-01 10:00:00.000000000 +1000 +++ freetype-2.13.3+dfsg/debian/patches/CVE-2026-95512.patch 2026-10-11 21:48:07.000000000 +1100 @@ -0,0 +1,46 @@ +From f3ca71c9900fe860849b3163a6e2c1e765b291d9 Mon Sep 17 00:00:00 2001 +From: Alexei Podtelezhnikov <[email protected]> +Date: Mon, 7 Sep 2026 15:02:23 -0400 +Subject: [PATCH] * src/cid/cidload.c (cid_read_subrs): Limit overlaps. + +Overlaps between subroutine dictionaries can be useful but prone to +abuses. The arbitrary limit can be adjusted in the future. Fixes #1457. + +Bug: https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1457 +Bug-Debian: https://bugs.debian.org/1149953 +Last-Update: 2026-10-05 + +--- + src/cid/cidload.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/src/cid/cidload.c b/src/cid/cidload.c +index 1a0e6b156..b9ab1b9e0 100644 +--- a/src/cid/cidload.c ++++ b/src/cid/cidload.c +@@ -517,6 +517,7 @@ + CID_Subrs subr; + FT_UInt max_offsets = 0; + FT_ULong* offsets = NULL; ++ FT_ULong cum_len = 0; + PSAux_Service psaux = (PSAux_Service)face->psaux; + + +@@ -584,6 +585,14 @@ + /* now, compute the size of subrs charstrings, */ + /* allocate, and read them */ + data_len = offsets[num_subrs] - offsets[0]; ++ cum_len += data_len; ++ ++ if ( cum_len / 4 > stream->size ) ++ { ++ FT_ERROR(( "cid_read_subrs: excessive overlaps\n" )); ++ error = FT_THROW( Invalid_File_Format ); ++ goto Fail; ++ } + + if ( FT_QNEW_ARRAY( subr->code, num_subrs + 1 ) || + FT_QALLOC( subr->code[0], data_len ) ) +-- +GitLab + diff -Nru freetype-2.13.3+dfsg/debian/patches/series freetype-2.13.3+dfsg/debian/patches/series --- freetype-2.13.3+dfsg/debian/patches/series 2026-03-18 07:21:34.000000000 +1100 +++ freetype-2.13.3+dfsg/debian/patches/series 2026-10-11 21:48:26.000000000 +1100 @@ -3,3 +3,4 @@ no-web-fonts.patch hide-donations-information.patch CVE-2026-23865.patch +CVE-2026-95512.patch
