[SECURITY] [DLA 1909-1] freetype security update

[Sylvain Beucler <beuc@beuc.net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Package        : freetype
Version        : 2.5.2-3+deb8u4
CVE ID         : CVE-2015-9381 CVE-2015-9382 CVE-2015-9383


Several newly-referenced issues have been fixed in the FreeType 2 font
engine.

CVE-2015-9381

  heap-based buffer over-read in T1_Get_Private_Dict in
  type1/t1parse.c

CVE-2015-9382

  buffer over-read in skip_comment in psaux/psobjs.c because
  ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face
  operation

CVE-2015-9383

  a heap-based buffer over-read in tt_cmap14_validate in
  sfnt/ttcmap.c

For Debian 8 "Jessie", these problems have been fixed in version
2.5.2-3+deb8u4.

We recommend that you upgrade your freetype packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEEQic8GuN/xDR88HkSj/HLbo2JBZ8FAl1vsDIACgkQj/HLbo2J
BZ99vwf/dhn8Cc2ypa3wHUPHzs5vk6Y1RLQexTgWloSxpG9yVZyrjOVKE4VKNAEz
MDg4B27vmW7aMvILHGgP5HQ5gnUQVkveKtU2vHQMB1ZPHbWDLBT88niQ0HQP8Yct
F/dCK88x6+/32I+O8H+irEZXj94wbK023AvKUHXHjkX7cHh9Xbn2y9TT9iQxnwrD
pjENycIp63Kfayk+iMHZaDoZfsyIGB3DZbEnoDICQWgzt+bCxcLkBSPbLgrF2o0j
zTpY2h8f6reMGEW/hEUxyh+yJEE8jjd7go04EZmjhCWArav6tPt0ByrSFfYIMkbF
mDWOhZ64MrQyP6op+/+0DGE0uNYN3g==
=MSV8
-----END PGP SIGNATURE-----