Re: Security Report: Unbounded Composite Glyph Recursion DoS (CWE-674)
J Laratro via FreeType development <[email protected]> Wed, 25 Mar 2026 13:01:09 -0700
| Newsgroups | gmane.comp.fonts.freetype.devel |
|---|---|
| Message-ID | <[email protected]> |
------=_Part_1794024_1432175807.1774468869344 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi, I apologize for the mistake, however, the process is really not clear. =C2=A0I looked at the website: http://freetype.org/contact.html=20 and saw that the contact mentioned engine internals which seemed to be the = closest category as there is no contact for security listed anywhere.=C2=A0 There is also no way to disclose security issues through the GitHub:=C2=A0 = https://github.com/freetype/freetype/security=20 I do this research in my free time, for free, and can only spend so much ti= me trying to track down documents. =E2=80=9CDiscusses engine internals, design issues, specific licenses, port= ing, etc. Mainly for software developers=E2=80=9D V/r, J Laratro https://jlaratro.us=20 https://aradex.io=20 https://github.com/jeremylaratro=20 ---- On Wed, 25 Mar 2026 10:38:08 -0700 Alan Coopersmith < mailto:alan.coop= [email protected] > wrote ---- On 3/24/26 22:18, d0sf3t wrote:=20 > I'm requesting a 90-day coordinated disclosure window from the date of yo= ur=20 > acknowledgment.=20 =20 You've mailed a public mailing list, with public archives visible at=20 https://lists.nongnu.org/archive/html/freetype-devel/2026-03/index.html =20 so you've already made an uncoordinated public disclosure.=20 =20 To report issues privately, you instead need to file an issue in the=20 tracker at=20 https://gitlab.freedesktop.org/freetype/freetype/-/issues =20 and set the confidentiality flag.=20 =20 --=20 -Alan Coopersmith- mailto:[email protected] =20 Oracle Solaris Engineering - https://blogs.oracle.com/solaris This email was sent from jlaratro.us and may contain confidential or privil= eged information intended only for the named=20 recipient(s). If you received it in error, please notify the sender and del= ete it. Unauthorized review, use, disclosure, or=20 distribution is prohibited.=20 =20 ------=_Part_1794024_1432175807.1774468869344 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head>= <meta content=3D"text/html;charset=3DUTF-8" http-equiv=3D"Content-Type"></h= ead><body ><div style=3D"font-family: Verdana; font-size: 11pt;"><div id=3D= "contentDiv"><div><div style=3D"font-family: Verdana; font-size: 11pt"><div= dir=3D"ltr" style=3D"text-align: left;">Hi,<br></div><div dir=3D"ltr" styl= e=3D"text-align: left"><br></div><div dir=3D"ltr" style=3D"text-align: left= ;">I apologize for the mistake, however, the process is really not clear.</= div><div dir=3D"ltr" style=3D"text-align: left;"> I looked at the webs= ite:<br></div><div dir=3D"ltr" style=3D"text-align: left"><a target=3D"_bla= nk" href=3D"http://freetype.org/contact.html">http://freetype.org/contact.h= tml</a><br></div><div dir=3D"ltr" style=3D"text-align: left;">and saw that = the contact mentioned engine internals which seemed to be the closest categ= ory as there is no contact for security listed anywhere. </div><div di= r=3D"ltr" style=3D"text-align: left;"><br></div><div dir=3D"ltr" style=3D"t= ext-align: left;">There is also no way to disclose security issues through = the GitHub: <a target=3D"_blank" href=3D"https://github.com/freetype/f= reetype/security">https://github.com/freetype/freetype/security</a><br></di= v><div dir=3D"ltr" style=3D"text-align: left"><br></div><div dir=3D"ltr" st= yle=3D"text-align: left;">I do this research in my free time, for free, and= can only spend so much time trying to track down documents.<br></div><div = dir=3D"ltr" style=3D"text-align: left"><br></div><div dir=3D"ltr" style=3D"= text-align: left;">=E2=80=9C<span class=3D"highlight" style=3D"background-c= olor: rgb(255, 255, 255);"><span class=3D"colour" style=3D"color: rgb(0, 0,= 0);"><span class=3D"font" style=3D"font-family:"Droid Serif", se= rif"><span class=3D"size" style=3D"font-size: large; font-style: normal; fo= nt-weight: 400; letter-spacing: normal; text-indent: 0px; text-transform: n= one; white-space: normal; word-spacing: 0px; text-decoration: none; text-al= ign: left; float: none;">Discusses engine internals, design issues, specifi= c licenses, porting, etc. Mainly for software developers=E2=80=9D</span></s= pan></span></span><br></div><div><br></div><div id=3D"x_1604368306signature= ElementId"><div><span class=3D"font" style=3D"font-family:"courier new= ", courier, monospace"></span><br></div><div><span class=3D"font" styl= e=3D"font-family: "courier new", courier, monospace;">V/r,<br></s= pan></div><div><span class=3D"font" style=3D"font-family: "courier new= ", courier, monospace;">J Laratro</span><br></div><div><a href=3D"http= s://jlaratro.us" target=3D"_blank"><span class=3D"font" style=3D"font-famil= y: "courier new", courier, monospace;">jlaratro.us</span></a><spa= n class=3D"font" style=3D"font-family:"courier new", courier, mon= ospace"><br></span></div><div><a href=3D"https://aradex.io" target=3D"_blan= k"><span class=3D"font" style=3D"font-family: "courier new", cour= ier, monospace;">aradex.io</span></a><span class=3D"font" style=3D"font-fam= ily:"courier new", courier, monospace"><br></span></div><div><a h= ref=3D"https://github.com/jeremylaratro" target=3D"_blank"><span class=3D"f= ont" style=3D"font-family: "courier new", courier, monospace;">gi= thub/jeremylaratro</span></a><br></div></div><div><br></div><div><div><br><= br></div><div class=3D"x_1604368306replyHeader"><br></div></div></div></div= ></div><div><br></div><div data-zbluepencil-ignore=3D"true">---- On Wed, 25= Mar 2026 10:38:08 -0700 <b>Alan Coopersmith <<a href=3D"mailto:alan.coo= [email protected]" target=3D"_blank">[email protected]</a>><= /b> wrote ----<br><div><br></div><div id=3D"zmail_block"><br></div><blockqu= ote style=3D"margin: 0 0 0 0"><div>On 3/24/26 22:18, d0sf3t wrote: <br>>= I'm requesting a 90-day coordinated disclosure window from the date of you= r <br>> acknowledgment. <br> <br>You've mailed a public mailing list, wi= th public archives visible at <br><a href=3D"https://lists.nongnu.org/archi= ve/html/freetype-devel/2026-03/index.html" target=3D"_blank">https://lists.= nongnu.org/archive/html/freetype-devel/2026-03/index.html</a> <br>so you've= already made an uncoordinated public disclosure. <br> <br>To report issues= privately, you instead need to file an issue in the <br>tracker at <br> <a= href=3D"https://gitlab.freedesktop.org/freetype/freetype/-/issues" target= =3D"_blank">https://gitlab.freedesktop.org/freetype/freetype/-/issues</a> <= br>and set the confidentiality flag. <br> <br>-- <br> -Alan Coopersmith- <a= href=3D"mailto:[email protected]" target=3D"_blank">alan.coopers= [email protected]</a> <br> Oracle Solaris Engineering - <a href=3D"https://bl= ogs.oracle.com/solaris" target=3D"_blank">https://blogs.oracle.com/solaris<= /a> <br></div></blockquote><div><br></div></div><div><br></div></div><br></= body></html><br><div><span style=3D"font-family:monospace"><span style=3D"c= olor: rgb(24, 178, 24); background-color: rgb(255, 255, 255);"><span class= =3D"colour" style=3D"color: rgb(0, 0, 0);">This email was sent from </span>= </span><span style=3D"font-weight: bold; color: rgb(24, 178, 24); backgroun= d-color: rgb(255, 255, 255);"><span class=3D"colour" style=3D"color: rgb(0,= 0, 0);">jlaratro.us</span></span><span style=3D"color: rgb(24, 178, 24); b= ackground-color: rgb(255, 255, 255);"><span class=3D"colour" style=3D"color= : rgb(0, 0, 0);"> and may contain confidential or privileged information in= tended only for the named</span></span><span style=3D"color: rgb(0, 0, 0); = background-color: rgb(255, 255, 255);"><span class=3D"colour" style=3D"colo= r: rgb(0, 0, 0);"> </span></span><span class=3D"colour" style=3D"color: rgb= (0, 0, 0);"><br></span><span style=3D"color: rgb(24, 178, 24); background-c= olor: rgb(255, 255, 255);"><span class=3D"colour" style=3D"color: rgb(0, 0,= 0);">recipient(s). If you received it in error, please notify the sender a= nd delete it. Unauthorized review, use, disclosure, or</span></span><span s= tyle=3D"color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><span c= lass=3D"colour" style=3D"color: rgb(0, 0, 0);"> </span></span><span class= =3D"colour" style=3D"color: rgb(0, 0, 0);"><br></span><span style=3D"color:= rgb(24, 178, 24); background-color: rgb(255, 255, 255);"><span class=3D"co= lour" style=3D"color: rgb(0, 0, 0);">distribution is prohibited.</span></sp= an><span style=3D"color: rgb(0, 0, 0); background-color: rgb(255, 255, 255)= ;"><span class=3D"colour" style=3D"color: rgb(0, 0, 0);"> </span></span><sp= an class=3D"colour" style=3D"color: rgb(0, 0, 0);"><br></span><span class= =3D"colour" style=3D"color: rgb(0, 0, 0);"><br></span><span style=3D"color:= rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><span class=3D"colour= " style=3D"color: rgb(0, 0, 0);"> </span></span></span><span class=3D"colou= r" style=3D"color: rgb(0, 0, 0);"><br></span></div> ------=_Part_1794024_1432175807.1774468869344--