Your message dated Sat, 07 Nov 2026 12:13:16 +0000
with message-id
<3a2ad004ad3ecf088c573dfa29005c9c11ff476a.ca...@adam-barratt.org.uk>
and subject line Re: Bug#1150614: bookworm-pu: package
freetype/2.12.1+dfsg-5+deb12u5
has caused the Debian Bug report #1150614,
regarding bookworm-pu: package freetype/2.12.1+dfsg-5+deb12u5
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150614: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150614
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: bookworm
X-Debbugs-Cc: [email protected]
Control: affects -1 + src:freetype
User: [email protected]
Usertags: pu
[ Reason ]
CVE-2026-95512: Prevent denial of service via repeated subroutine allocations
in the CID font loader.
Crafted CID fonts can trigger repeated subroutine allocations and
decryptions across many font dictionaries during face loading,
causing severe memory and CPU exhaustion.
[ Impact ]
A remote attacker could exploit a vulnerability in FreeType's CID font loader
by tricking a user into opening content that embeds or references a specially
crafted CID-keyed font. This crafted font can cause repeated allocations and
decryptions of subroutine data across multiple font dictionaries, leading to
excessive memory and CPU consumption. This can result in a denial of service
(DoS) for the application or service processing the font, potentially causing
it to hang or terminate.
[ Tests ]
Manual testing.
[ Risks ]
The patch was developed by an upstream FreeType developer and verified by
another.
[ Checklist ]
[X] *all* changes are documented in the d/changelog
[X] I reviewed all changes and I approve them
[X] attach debdiff against the package in (old)stable
[X] the issue is verified as fixed in unstable
[ Changes ]
This upload adds an upstream patch to fix CVE-2026-95512. It is the same patch
applied to Sid and Forky, and will be applied to Trixie too.
[ Other info ]
Debian Security Team advised no DSA with my agreement.
diff -Nru freetype-2.12.1+dfsg/debian/changelog
freetype-2.12.1+dfsg/debian/changelog
--- freetype-2.12.1+dfsg/debian/changelog 2025-03-15 06:57:00.000000000
+1100
+++ freetype-2.12.1+dfsg/debian/changelog 2026-10-11 22:19:01.000000000
+1100
@@ -1,3 +1,9 @@
+freetype (2.12.1+dfsg-5+deb12u5) bookworm; urgency=medium
+
+ * debian/patches: Fix CVE-2026-95512 (Closes: #1149953).
+
+ -- Hugh McMaster <[email protected]> Sun, 11 Oct 2026 22:19:01 +1100
+
freetype (2.12.1+dfsg-5+deb12u4) bookworm-security; urgency=high
* Non-maintainer upload by the Security Team.
diff -Nru freetype-2.12.1+dfsg/debian/patches/CVE-2026-95512.patch
freetype-2.12.1+dfsg/debian/patches/CVE-2026-95512.patch
--- freetype-2.12.1+dfsg/debian/patches/CVE-2026-95512.patch 1970-01-01
10:00:00.000000000 +1000
+++ freetype-2.12.1+dfsg/debian/patches/CVE-2026-95512.patch 2026-10-11
22:15:24.000000000 +1100
@@ -0,0 +1,41 @@
+From f3ca71c9900fe860849b3163a6e2c1e765b291d9 Mon Sep 17 00:00:00 2001
+From: Alexei Podtelezhnikov <[email protected]>
+Date: Mon, 7 Sep 2026 15:02:23 -0400
+Subject: [PATCH] * src/cid/cidload.c (cid_read_subrs): Limit overlaps.
+
+Overlaps between subroutine dictionaries can be useful but prone to
+abuses. The arbitrary limit can be adjusted in the future. Fixes #1457.
+
+Bug: https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1457
+Bug-Debian: https://bugs.debian.org/1149953
+Last-Update: 2026-10-05
+
+---
+ src/cid/cidload.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/src/cid/cidload.c
++++ b/src/cid/cidload.c
+@@ -521,6 +521,7 @@
+ CID_Subrs subr;
+ FT_UInt max_offsets = 0;
+ FT_ULong* offsets = NULL;
++ FT_ULong cum_len = 0;
+ PSAux_Service psaux = (PSAux_Service)face->psaux;
+
+
+@@ -588,6 +589,14 @@
+ /* now, compute the size of subrs charstrings, */
+ /* allocate, and read them */
+ data_len = offsets[num_subrs] - offsets[0];
++ cum_len += data_len;
++
++ if ( cum_len / 4 > stream->size )
++ {
++ FT_ERROR(( "cid_read_subrs: excessive overlaps\n" ));
++ error = FT_THROW( Invalid_File_Format );
++ goto Fail;
++ }
+
+ if ( FT_QNEW_ARRAY( subr->code, num_subrs + 1 ) ||
+ FT_QALLOC( subr->code[0], data_len ) )
diff -Nru freetype-2.12.1+dfsg/debian/patches/series
freetype-2.12.1+dfsg/debian/patches/series
--- freetype-2.12.1+dfsg/debian/patches/series 2025-03-15 06:56:20.000000000
+1100
+++ freetype-2.12.1+dfsg/debian/patches/series 2026-10-11 22:14:37.000000000
+1100
@@ -9,3 +9,4 @@
disable_COLRv1.patch
get_colr_glyph_paint.patch
Minimal-stop-gap-fix-for-CVE-2025-27363.patch
+CVE-2026-95512.patch
--- End Message ---
--- Begin Message ---
On Sun, 2026-10-11 at 23:05 +1100, Hugh McMaster wrote:
> Package: release.debian.org
> Severity: normal
> Tags: bookworm
SRM haven't managed bookworm for a few months now. Please co-ordinate
any potential updates to bookwork with the LTS Team.
Regards,
Adam
--- End Message ---
