Bug 833565 (CVE-2022-23318, CVE-2022-23319)

Summary:	media-fonts/pcf2bdf: multiple vulnerabilities
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	minor	CC:	fonts
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/ganaware/pcf2bdf/releases/tag/1.07
Whiteboard:	B3 [ebuild]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2022-02-17 20:42:42 UTC

CVE-2022-23319 (https://github.com/ganaware/pcf2bdf):

A segmentation fault during PCF file parsing in pcf2bdf versions >=1.05 allows an attacker to trigger a program crash via a specially crafted PCF font file. This crash affects the availability of the software and dependent downstream components.

This CVE has a practically useless description and no references other
than the GitHub repository. However, there are a bunch of obvious
security fix commits, so would be best to get a snapshot:
https://github.com/ganaware/pcf2bdf/commits/master

Comment 1 Hans de Graaff gentoo-dev

2023-10-25 11:48:29 UTC

This has been fixed in pcf2bdf-1.07.