The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade freetypeUpgrade freetype-develUpgrade freetype-demos | Dec 1, 2016 | Feb 8, 2015 |
| Debian | — | Upgrade freetype | Jul 30, 2024 | Feb 8, 2015 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jul 9, 2015 |
| Gentoo Linux | — | Upgrade media-libs/freetype. | Oct 30, 2017 | Feb 8, 2015 |
| Oracle Solaris | — | Upgrade consolidation/X/X-incorporation to version 0.5.11-0.175.3.0.0.30.1483 on Solaris 11.3Upgrade system/library/freetype-2 to version 2.5.5-0.175.2.10.0.3.1434 on Solaris 11.2 | May 29, 2017 | Feb 8, 2015 |
| Oracle_linux | — | Upgrade freetype-develUpgrade freetype-demosUpgrade freetype | Oct 16, 2024 | Feb 8, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 24, 2014 |
| Suse | — | Upgrade freetype2-devel-32bitUpgrade ftdiffUpgrade ftgammaUpgrade ftdumpUpgrade freetype2-x86Upgrade freetype2-develUpgrade ftvalidUpgrade libfreetype6Upgrade ftgridUpgrade ftviewUpgrade ftlintUpgrade libfreetype6-32bitUpgrade ftstringUpgrade ft2demosUpgrade ftbenchUpgrade ftinspectUpgrade ftmultiUpgrade freetype2Upgrade freetype2-32bit | Dec 18, 2015 | Feb 8, 2015 |
| Ubuntu | — | Upgrade libfreetype6 | Nov 8, 2024 | Feb 8, 2015 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub