The FT_Stream_EnterFrame function in base/ftstream.c in FreeType before 2.4.2 does not properly validate certain position values, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx X11 | — | Upgrade macOS to the latest versionApply OS X security update 2010-007 | Dec 16, 2011 | Aug 19, 2010 |
| Debian | — | Upgrade freetype | Jul 30, 2024 | Aug 19, 2010 |
| Gentoo Linux | — | Upgrade media-libs/freetype. | Oct 30, 2017 | Aug 19, 2010 |
| Oracle_linux | — | Upgrade freetype-demosUpgrade freetype-develUpgrade freetype | Oct 16, 2024 | Aug 19, 2010 |
| Suse | — | Upgrade freetype2-develUpgrade ftviewUpgrade freetype2Upgrade freetype2-devel-32bitUpgrade ftlintUpgrade ft2demosUpgrade freetype2-32bitUpgrade libfreetype6-32bitUpgrade ftdiffUpgrade ftdumpUpgrade ftgammaUpgrade ftstringUpgrade ftmultiUpgrade ftgridUpgrade ftsdfUpgrade ftbenchUpgrade freetype2-profile-tti35Upgrade ftvalidUpgrade freetype2-x86Upgrade libfreetype6Upgrade ftinspect | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libfreetype6 | Nov 8, 2024 | Aug 19, 2010 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub