The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) via vectors related to BDF fonts and an ENCODING field with a negative value.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade freetype | Jul 30, 2024 | Jan 24, 2013 |
| Gentoo Linux | — | Upgrade media-libs/freetype. | Oct 30, 2017 | Jan 24, 2013 |
| Oracle Solaris | — | Upgrade system/library/freetype-2 to version 2.4.11-0.175.1.18.0.1.1350 on Solaris 11.1 | May 29, 2017 | Jan 24, 2013 |
| Suse | — | Upgrade ftgammaUpgrade ftvalidUpgrade freetype2-profile-tti35Upgrade ftsdfUpgrade ftmultiUpgrade freetype2-x86Upgrade ftstringUpgrade libfreetype6Upgrade ftbenchUpgrade ft2demosUpgrade ftinspectUpgrade ftgridUpgrade ftdiffUpgrade ftviewUpgrade ftdumpUpgrade ftlintUpgrade freetype2-32bitUpgrade freetype2-devel-32bitUpgrade freetype2Upgrade libfreetype6-32bitUpgrade freetype2-devel | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libfreetype6 | Nov 8, 2024 | Jan 24, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub