The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade freetype | Aug 30, 2017 | Feb 8, 2015 |
| Centos_linux | — | Upgrade freetype-demosUpgrade freetype-develUpgrade freetype | Dec 1, 2016 | Feb 8, 2015 |
| Debian | — | Upgrade freetype | Feb 2, 2016 | Feb 8, 2015 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jul 9, 2015 |
| Gentoo Linux | — | Upgrade media-libs/freetype. | Oct 30, 2017 | Feb 8, 2015 |
| Oracle Solaris | — | Upgrade system/library/freetype-2 to version 2.5.5-0.175.2.10.0.3.1434 on Solaris 11.2Upgrade consolidation/X/X-incorporation to version 0.5.11-0.175.3.0.0.30.1483 on Solaris 11.3 | May 29, 2017 | Feb 8, 2015 |
| Oracle_linux | — | Upgrade freetype-develUpgrade freetypeUpgrade freetype-demos | Oct 16, 2024 | Feb 8, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 8, 2015 |
| Suse | — | Upgrade ftmultiUpgrade freetype2-x86Upgrade ftbenchUpgrade freetype2-32bitUpgrade ftinspectUpgrade ftgammaUpgrade ft2demosUpgrade freetype2Upgrade ftgridUpgrade libfreetype6Upgrade ftlintUpgrade libfreetype6-32bitUpgrade ftstringUpgrade ftdumpUpgrade ftdiffUpgrade ftviewUpgrade freetype2-devel-32bitUpgrade freetype2-develUpgrade ftvalid | Dec 18, 2015 | Feb 8, 2015 |
| Ubuntu | — | Upgrade libfreetype6 | Nov 8, 2024 | Feb 8, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub