Integer overflow in FreeType before 2.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PCF file, as demonstrated by the Red Hat bad1.pcf test file, due to a partial fix of CVE-2006-1861.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx X11 | — | Apply OS X security update 2009-001 | Dec 16, 2011 | Jul 21, 2006 |
| Debian | — | Upgrade libxfontUpgrade freetype | Jul 30, 2024 | Jul 21, 2006 |
| Freebsd | — | Upgrade freetype2 | Dec 10, 2025 | Oct 2, 2006 |
| Gentoo Linux | — | Upgrade x11-libs/libXfont. | Oct 30, 2017 | Jul 21, 2006 |
| Suse | — | Upgrade NXUpgrade freetype2-devel-64bitUpgrade freetype2-develUpgrade XFree86-serverUpgrade freetype2-devel-32bitUpgrade freetype2-32bitUpgrade freetype2Upgrade freetype2-x86Upgrade suse-releaseUpgrade freetype2-64bit | Feb 17, 2015 | Jul 21, 2006 |
| Ubuntu | — | Upgrade libfs6Upgrade libfreetype6Upgrade xserver-xorgUpgrade libxfont1 | Nov 8, 2024 | Jul 21, 2006 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub