1. Forum
  2. Usenet
  3. LINUX.DEBIAN.USER

  • libfreetype6 mitigations?

    From Richmond@21:1/5 to All on Thu Mar 13 12:30:01 2025
    Is there anything that can be done to mitigate against the vulnerability
    which is apparently according to Bleeping Computer being exploited
    arbitrary code execution? I looked into upgrading that package to the
    testing version but I think it would cause problems.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Dan Ritter@21:1/5 to Richmond on Thu Mar 13 14:50:01 2025
    Richmond wrote:
    Is there anything that can be done to mitigate against the vulnerability which is apparently according to Bleeping Computer being exploited
    arbitrary code execution? I looked into upgrading that package to the
    testing version but I think it would cause problems.



    https://security-tracker.debian.org/tracker/CVE-2025-27363

    It's being tracked. Expect a fix in a few days.

    -dsr-

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Richmond@21:1/5 to Dan Ritter on Thu Mar 13 15:10:01 2025
    Dan Ritter <[email protected]> writes:

    Richmond wrote:
    Is there anything that can be done to mitigate against the vulnerability
    which is apparently according to Bleeping Computer being exploited
    arbitrary code execution? I looked into upgrading that package to the
    testing version but I think it would cause problems.



    https://security-tracker.debian.org/tracker/CVE-2025-27363

    It's being tracked. Expect a fix in a few days.


    Thanks. Do you think preventing pages from loading their own fonts (in
    firefox) would stop the attack?

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Dan Ritter@21:1/5 to Richmond on Thu Mar 13 16:10:01 2025
    Richmond wrote:
    Dan Ritter <[email protected]> writes:

    Richmond wrote:
    Is there anything that can be done to mitigate against the vulnerability >> which is apparently according to Bleeping Computer being exploited
    arbitrary code execution? I looked into upgrading that package to the
    testing version but I think it would cause problems.



    https://security-tracker.debian.org/tracker/CVE-2025-27363

    It's being tracked. Expect a fix in a few days.


    Thanks. Do you think preventing pages from loading their own fonts (in firefox) would stop the attack?

    I think it's almost always a good idea, unless you are dependent
    on multiple languages and hate the Noto fonts.

    -dsr-

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)