Integer overflow in base/ftstream.c in libXft (aka the X FreeType library) in FreeType before 2.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Compact Font Format (CFF) font file that triggers a heap-based buffer overflow, related to an "input stream position error" issue, a different vulnerability than CVE-2010-1797.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade freetype-utilsUpgrade freetype-demosUpgrade freetypeUpgrade freetype-devel | Dec 1, 2016 | Jan 7, 2011 |
| Debian | — | Upgrade freetype | Jul 30, 2024 | Jan 7, 2011 |
| Gentoo Linux | — | Upgrade media-libs/freetype. | Oct 30, 2017 | Jan 7, 2011 |
| Oracle_linux | — | Upgrade freetype-demosUpgrade freetype-develUpgrade freetype | Oct 16, 2024 | Jan 7, 2011 |
| Suse | — | Upgrade ftviewUpgrade ftgammaUpgrade ftstringUpgrade ftmultiUpgrade ftvalidUpgrade ftdiffUpgrade freetype2-x86Upgrade freetype2-devel-32bitUpgrade libfreetype6Upgrade ftsdfUpgrade ftbenchUpgrade ftgridUpgrade freetype2-profile-tti35Upgrade freetype2Upgrade ftlintUpgrade libfreetype6-32bitUpgrade freetype2-develUpgrade ftinspectUpgrade ftdumpUpgrade ft2demosUpgrade freetype2-32bit | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libfreetype6 | Nov 8, 2024 | Jan 7, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub