Heap-based buffer overflow in the Ins_IUP function in truetype/ttinterp.c in FreeType before 2.4.0, when TrueType bytecode support is enabled, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx X11 | — | Apply OS X security update 2010-007Upgrade macOS to the latest version | Dec 16, 2011 | Aug 19, 2010 |
| Debian | — | Upgrade freetype | Jul 30, 2024 | Aug 19, 2010 |
| Gentoo Linux | — | Upgrade media-libs/freetype. | Oct 30, 2017 | Aug 19, 2010 |
| Suse | — | Upgrade freetype2-32bitUpgrade freetype2Upgrade freetype2-x86 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libfreetype6 | Nov 8, 2024 | Aug 19, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub