Re: Security Report: Unbounded Composite Glyph Recursion DoS (CWE-674)
J Laratro <[email protected]> Wed, 25 Mar 2026 14:42:10 -0700
| Newsgroups | gmane.comp.fonts.freetype.devel |
|---|---|
| Message-ID | <[email protected]> |
------=_Part_1764716_1837038419.1774474930873 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit Noted! -J ---- On Wed, 25 Mar 2026 14:20:38 -0700 Alan Coopersmith <[email protected]> wrote ---- On 3/25/26 13:01, J Laratro wrote: > There is also no way to disclose security issues through the GitHub: https:// > github.com/freetype/freetype/security As it says on the front page of https://github.com/freetype/freetype the github is just a mirror of the main repo at https://gitlab.freedesktop.org/freetype/freetype and if you scroll down to the README on the github you'll see it also links to the gitlab to report bugs. -- -Alan Coopersmith- mailto:[email protected] Oracle Solaris Engineering - https://blogs.oracle.com/solaris This email was sent from jlaratro.us and may contain confidential or privileged information intended only for the named recipient(s). If you received it in error, please notify the sender and delete it. Unauthorized review, use, disclosure, or distribution is prohibited. ------=_Part_1764716_1837038419.1774474930873 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head>= <meta content=3D"text/html;charset=3DUTF-8" http-equiv=3D"Content-Type"></h= ead><body ><div style=3D"font-family: Verdana; font-size: 11pt;"><div dir= =3D"ltr" style=3D"text-align: left;">Noted!</div><div><br></div><div id=3D"= signatureElementId"><span class=3D"font" style=3D"font-family:"courier= new", courier, monospace"></span><div>-J</div></div><div data-zbluepe= ncil-ignore=3D"true"><div><br><br></div><div class=3D"replyHeader">---- On = Wed, 25 Mar 2026 14:20:38 -0700 <b>Alan Coopersmith <alan.coopersmith@or= acle.com></b> wrote ----<br></div><div><br></div><blockquote style=3D"ma= rgin:0 0 0 0"><div>On 3/25/26 13:01, J Laratro wrote: <br>> There is als= o no way to disclose security issues through the GitHub: https:// <br>> = github.com/freetype/freetype/security <br> <br>As it says on the front page= of <a href=3D"https://github.com/freetype/freetype" target=3D"_blank">http= s://github.com/freetype/freetype</a> the <br>github is just a mirror of the= main repo at <br><a href=3D"https://gitlab.freedesktop.org/freetype/freety= pe" target=3D"_blank">https://gitlab.freedesktop.org/freetype/freetype</a> = <br>and if you scroll down to the README on the github you'll see it also <= br>links to the gitlab to report bugs. <br> <br>-- <br> -Alan Coopersmith- = <a href=3D"mailto:[email protected]" target=3D"_blank">alan.coope= [email protected]</a> <br> Oracle Solaris Engineering - <a href=3D"https://= blogs.oracle.com/solaris" target=3D"_blank">https://blogs.oracle.com/solari= s</a> <br></div></blockquote></div><div><br></div></div><br></body></html><= br><div><span style=3D"font-family:monospace"><span style=3D"color: rgb(24,= 178, 24); background-color: rgb(255, 255, 255);"><span class=3D"colour" st= yle=3D"color: rgb(0, 0, 0);">This email was sent from </span></span><span s= tyle=3D"font-weight: bold; color: rgb(24, 178, 24); background-color: rgb(2= 55, 255, 255);"><span class=3D"colour" style=3D"color: rgb(0, 0, 0);">jlara= tro.us</span></span><span style=3D"color: rgb(24, 178, 24); background-colo= r: rgb(255, 255, 255);"><span class=3D"colour" style=3D"color: rgb(0, 0, 0)= ;"> and may contain confidential or privileged information intended only fo= r the named</span></span><span style=3D"color: rgb(0, 0, 0); background-col= or: rgb(255, 255, 255);"><span class=3D"colour" style=3D"color: rgb(0, 0, 0= );"> </span></span><span class=3D"colour" style=3D"color: rgb(0, 0, 0);"><b= r></span><span style=3D"color: rgb(24, 178, 24); background-color: rgb(255,= 255, 255);"><span class=3D"colour" style=3D"color: rgb(0, 0, 0);">recipien= t(s). If you received it in error, please notify the sender and delete it. = Unauthorized review, use, disclosure, or</span></span><span style=3D"color:= rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><span class=3D"colour= " style=3D"color: rgb(0, 0, 0);"> </span></span><span class=3D"colour" styl= e=3D"color: rgb(0, 0, 0);"><br></span><span style=3D"color: rgb(24, 178, 24= ); background-color: rgb(255, 255, 255);"><span class=3D"colour" style=3D"c= olor: rgb(0, 0, 0);">distribution is prohibited.</span></span><span style= =3D"color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><span class= =3D"colour" style=3D"color: rgb(0, 0, 0);"> </span></span><span class=3D"co= lour" style=3D"color: rgb(0, 0, 0);"><br></span><span class=3D"colour" styl= e=3D"color: rgb(0, 0, 0);"><br></span><span style=3D"color: rgb(0, 0, 0); b= ackground-color: rgb(255, 255, 255);"><span class=3D"colour" style=3D"color= : rgb(0, 0, 0);"> </span></span></span><span class=3D"colour" style=3D"colo= r: rgb(0, 0, 0);"><br></span></div> ------=_Part_1764716_1837038419.1774474930873--