An issue was discovered in FreeType 2 through 2.9. A NULL pointer dereference in the Ins_GETVARIATION() function within ttinterp.c could lead to DoS via a crafted font file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade freetype | Jun 15, 2018 | Feb 13, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 13, 2018 |
| Debian | — | Upgrade freetype | Jul 30, 2024 | Feb 13, 2018 |
| Oracle Solaris | — | Upgrade system/library/freetype-2 to version 2.9-0.175.3.33.0.4.1549 on Solaris 11.3 | Jun 18, 2018 | Feb 13, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 13, 2018 |
| Suse | — | Upgrade freetype2-profile-tti35Upgrade ftmultiUpgrade ftgammaUpgrade ftbenchUpgrade ftstringUpgrade ftvalidUpgrade ft2demosUpgrade ftinspectUpgrade libfreetype6Upgrade ftgridUpgrade ftdiffUpgrade ftdumpUpgrade freetype2-devel-32bitUpgrade ftlintUpgrade libfreetype6-32bitUpgrade ftviewUpgrade freetype2-devel | May 24, 2020 | Feb 13, 2018 |
| Ubuntu | — | Upgrade libfreetype6 | Feb 15, 2018 | Feb 13, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 13, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub