Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade freetype-develUpgrade freetype-demosUpgrade freetype | Dec 1, 2016 | Feb 8, 2015 |
| Debian | — | Upgrade freetype | Jul 30, 2024 | Feb 8, 2015 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jul 9, 2015 |
| Gentoo Linux | — | Upgrade media-libs/freetype. | Oct 30, 2017 | Feb 8, 2015 |
| Oracle Solaris | — | Upgrade system/library/freetype-2 to version 2.5.5-0.175.2.10.0.3.1434 on Solaris 11.2Upgrade consolidation/X/X-incorporation to version 0.5.11-0.175.3.0.0.30.1483 on Solaris 11.3 | May 29, 2017 | Feb 8, 2015 |
| Oracle_linux | — | Upgrade freetype-demosUpgrade freetype-develUpgrade freetype | Oct 16, 2024 | Feb 8, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 24, 2014 |
| Suse | — | Upgrade libfreetype6-32bitUpgrade ftdumpUpgrade ftgridUpgrade freetype2-x86Upgrade libfreetype6Upgrade freetype2-develUpgrade freetype2Upgrade freetype2-devel-32bitUpgrade ftdiffUpgrade ftgammaUpgrade ftstringUpgrade ftinspectUpgrade ftmultiUpgrade freetype2-32bitUpgrade ftlintUpgrade ftvalidUpgrade ftbenchUpgrade ft2demosUpgrade ftview | Dec 18, 2015 | Feb 8, 2015 |
| Ubuntu | — | Upgrade libfreetype6 | Nov 8, 2024 | Feb 8, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub