{"id":122211,"date":"2025-03-15T08:22:16","date_gmt":"2025-03-15T06:22:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-vo-freetype-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-shriftov"},"modified":"2025-03-15T08:22:16","modified_gmt":"2025-03-15T06:22:16","slug":"uyazvimost-vo-freetype-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-shriftov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/de\/blog\/novosti-interneta\/uyazvimost-vo-freetype-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-shriftov","title":{"rendered":"Sicherheitsanf\u00e4lligkeit in FreeType erm\u00f6glicht die Ausf\u00fchrung von Code bei der Verarbeitung von Schriften","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

In der Schriftbibliothek FreeType wurde eine Sicherheitsanf\u00e4lligkeit (CVE-2025-27363) entdeckt, die potenziell zur Ausf\u00fchrung von Code f\u00fchren kann, wenn speziell gestaltete Dateien mit variablen Schriftarten oder schriften im TrueType GX-Format verarbeitet werden. Das Problem tritt nur in Versionen von FreeType bis einschlie\u00dflich 2.13.0 auf und wurde in Version 2.13.1 (Juni 2023) behoben. Es wird angenommen, dass diese Sicherheitsanf\u00e4lligkeit bereits zuvor f\u00fcr Angriffe ausgenutzt wurde. <\/p>\n

Die Schwachstelle entsteht durch einen Puffer\u00fcberlauf, der beim Parsen von Subglyph-Strukturen in Schriftarten auftritt. Der \u00dcberlauf tritt auf, weil einer Variablen vom Typ \u201esigned short\u201c, die an der Berechnung der Puffergr\u00f6\u00dfe beteiligt ist, ein Wert vom Typ \u201eunsigned long\u201c zugewiesen wird. Dies kann zu einem \u00dcberlauf bei Ganzzahlen und zur Zuweisung eines falschen Puffertyps f\u00fchren. In der Folge werden mindestens 6 signierte Ganzzahlen vom Typ \u201elong\u201c au\u00dferhalb dieses Puffers geschrieben. <\/p>\n

Updates zu Distributionen k\u00f6nnen auf den folgenden Seiten verfolgt werden: Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD. Laut der Statistik der verwendeten Versionen werden verwundbare FreeType-Versionen in den Distributionen Amazon Linux 2, Debian stable \/ Devuan, RHEL 8 und 9 (+ CentOS Stream und abgeleitete Distributionen), GNU Guix, Mageia, OpenMandriva, openSUSE Leap, Slackware und Ubuntu 22.04 bereitgestellt.
\n
Quelle: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 \u043e\u0442\u0440\u0438\u0441\u043e\u0432\u043a\u0438 \u0448\u0440\u0438\u0444\u0442\u043e\u0432 FreeType \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-27363), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u0432\u0430\u0440\u0438\u0430\u0442\u0438\u0432\u043d\u044b\u043c\u0438 \u0448\u0440\u0438\u0444\u0442\u0430\u043c\u0438 \u0438\u043b\u0438 \u0448\u0440\u0438\u0444\u0442\u0430\u043c\u0438 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 TrueType GX. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 FreeType \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 2.13.0 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 2.13.1 (\u0438\u044e\u043d\u044c 2023 \u0433\u043e\u0434\u0430). \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0436\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0430\u0441\u044c \u0440\u0430\u043d\u0435\u0435 \u0434\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-122211","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Schwachstelle in FreeType, die die Codeausf\u00fchrung bei der Verarbeitung von Schriften erm\u00f6glicht | ProHoster","description":"In der Schriftbibliothek FreeType wurde eine Schwachstelle (CVE-2025-27363) festgestellt, die potenziell zur Ausf\u00fchrung von Code f\u00fchren k\u00f6nnte, wenn speziell gestaltete Dateien mit variablen Schriften oder Schriften im TrueType GX-Format verarbeitet werden. Das Problem tritt nur in FreeType-Versionen vor 2.13.0 einschliesslich auf und wurde in Version 2.13.1 (Juni 2023) behoben. Es wird vermutet, dass die Schwachstelle bereits zuvor ausgenutzt wurde.","canonical_url":"https:\/\/prohoster.info\/de\/blog\/novosti-interneta\/uyazvimost-vo-freetype-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-shriftov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"de_DE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043e FreeType, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0448\u0440\u0438\u0444\u0442\u043e\u0432 | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 \u043e\u0442\u0440\u0438\u0441\u043e\u0432\u043a\u0438 \u0448\u0440\u0438\u0444\u0442\u043e\u0432 FreeType \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-27363), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u0432\u0430\u0440\u0438\u0430\u0442\u0438\u0432\u043d\u044b\u043c\u0438 \u0448\u0440\u0438\u0444\u0442\u0430\u043c\u0438 \u0438\u043b\u0438 \u0448\u0440\u0438\u0444\u0442\u0430\u043c\u0438 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 TrueType GX. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 FreeType \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 2.13.0 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 2.13.1 (\u0438\u044e\u043d\u044c 2023 \u0433\u043e\u0434\u0430). \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0436\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0430\u0441\u044c \u0440\u0430\u043d\u0435\u0435 \u0434\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f","og:url":"https:\/\/prohoster.info\/de\/blog\/novosti-interneta\/uyazvimost-vo-freetype-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-shriftov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-03-15T06:22:16+00:00","article:modified_time":"2025-03-15T06:22:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"122211","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 11:07:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 11:07:22","updated":"2026-01-23 11:07:22"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/122211","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/comments?post=122211"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/122211\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/media?parent=122211"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/categories?post=122211"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/tags?post=122211"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}