The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to BDF fonts and an incorrect calculation that triggers an out-of-bounds read.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade freetype | Aug 30, 2017 | Jan 24, 2013 |
| Centos_linux | — | Upgrade freetype-develUpgrade freetype-demosUpgrade freetype | Dec 1, 2016 | Jan 24, 2013 |
| Debian | — | Upgrade freetype | Jul 30, 2024 | Jan 24, 2013 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Feb 2, 2016 |
| Gentoo Linux | — | Upgrade media-libs/freetype. | Oct 30, 2017 | Jan 24, 2013 |
| Oracle Solaris | — | Upgrade system/library/freetype-2 to version 2.4.11-0.175.1.18.0.1.1350 on Solaris 11.1 | May 29, 2017 | Jan 24, 2013 |
| Oracle_linux | — | Upgrade freetypeUpgrade freetype-demosUpgrade freetype-devel | Oct 16, 2024 | Jan 24, 2013 |
| Suse | — | Upgrade ftinspectUpgrade freetype2-develUpgrade ftgammaUpgrade freetype2-profile-tti35Upgrade ftviewUpgrade freetype2-devel-32bitUpgrade ftbenchUpgrade ftdumpUpgrade libfreetype6Upgrade ftstringUpgrade ftsdfUpgrade ftvalidUpgrade ftdiffUpgrade ftgridUpgrade ftlintUpgrade ft2demosUpgrade freetype2-32bitUpgrade freetype2Upgrade ftmultiUpgrade freetype2-x86Upgrade libfreetype6-32bit | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libfreetype6 | Nov 8, 2024 | Jan 24, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub