cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted OTF font.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade freetype | Jul 30, 2024 | Feb 8, 2015 |
| Gentoo Linux | — | Upgrade media-libs/freetype. | Oct 30, 2017 | Feb 8, 2015 |
| Suse | — | Upgrade freetype2Upgrade ftlintUpgrade ft2demosUpgrade libfreetype6-32bitUpgrade ftinspectUpgrade ftmultiUpgrade freetype2-32bitUpgrade ftbenchUpgrade ftgammaUpgrade ftvalidUpgrade freetype2-x86Upgrade ftgridUpgrade ftdiffUpgrade libfreetype6Upgrade ftviewUpgrade freetype2-develUpgrade ftdumpUpgrade freetype2-devel-32bitUpgrade ftstring | Dec 18, 2015 | Feb 8, 2015 |
| Ubuntu | — | Upgrade libfreetype6 | Nov 8, 2024 | Feb 8, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub