Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
7.5
CVSSv2

CVE-2009-0946

Published: 17/04/2009 Updated: 05/04/2021
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
VMScore: 668
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Subscribe to Freetype

Vulnerability Summary

Multiple integer overflows in FreeType 2.3.9 and previous versions allow remote malicious users to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

freetype freetype

debian debian linux 4.0

debian debian linux 5.0

debian debian linux 6.0

canonical ubuntu linux 6.06

canonical ubuntu linux 8.04

canonical ubuntu linux 8.10

canonical ubuntu linux 9.04

opensuse opensuse 10.3

opensuse opensuse 11.0

opensuse opensuse 11.1

suse linux enterprise server 10

suse linux enterprise server 11

apple safari 4.0

apple iphone os

apple mac os x 10.4.11

apple mac os x 10.5.8

apple mac os x

apple mac os x server 10.4.11

apple mac os x server 10.5.8

apple mac os x server

Vendor Advisories

Debian CVElist Bug Report Logs: freetype: multiple integer overflows
Debian Bug report logs - #524925 freetype: multiple integer overflows Package: freetype; Maintainer for freetype is Hugh McMaster <hughmcmaster@outlookcom>; Reported by: Nico Golde <nion@debianorg> Date: Mon, 20 Apr 2009 20:42:02 UTC Severity: grave Tags: patch, security Fixed in versions freetype/239-41, free ...
Ubuntu Security Notice: freetype vulnerability
Tavis Ormandy discovered that FreeType did not correctly handle certain large values in font files If a user were tricked into using a specially crafted font file, a remote attacker could execute arbitrary code with user privileges ...
Red Hat: Important: freetype security update
Synopsis Important: freetype security update Type/Severity Security Advisory: Important Topic Updated freetype packages that fix various security issues are nowavailable for Red Hat Enterprise Linux 3 and 4This update has been rated as having important security impact by the RedHat Security Response Team ...
Red Hat: Important: freetype security update
Synopsis Important: freetype security update Type/Severity Security Advisory: Important Topic Updated freetype packages that fix various security issues are nowavailable for Red Hat Enterprise Linux 21This update has been rated as having important security impact by the RedHat Security Response Team ...
Red Hat: Important: freetype security update
Synopsis Important: freetype security update Type/Severity Security Advisory: Important Topic Updated freetype packages that fix various security issues are nowavailable for Red Hat Enterprise Linux 5This update has been rated as having important security impact by the RedHat Security Response Team ...
Debian Security Advisories: DSA-1784-1 freetype -- integer overflows
Tavis Ormandy discovered several integer overflows in FreeType, a library to process and access font files, resulting in heap- or stack-based buffer overflows leading to application crashes or the execution of arbitrary code via a crafted font file For the oldstable distribution (etch), this problem has been fixed in version 221-5+etch4 For the ...

References

CWE-190https://bugzilla.redhat.com/show_bug.cgi?id=491384http://secunia.com/advisories/34723http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=79972af4f0485a11dcb19551356c45245749fc5bhttp://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0545ec1ca36b27cb928128870a83e5f668980bc5http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=a18788b14db60ae3673f932249cd02d33a227c4ehttp://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/ChangeLoghttp://www.vupen.com/english/advisories/2009/1058http://www.securityfocus.com/bid/34550http://secunia.com/advisories/34913http://www.ubuntu.com/usn/USN-767-1http://secunia.com/advisories/34967http://www.debian.org/security/2009/dsa-1784http://secunia.com/advisories/35065http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.htmlhttp://www.vupen.com/english/advisories/2009/1297http://www.us-cert.gov/cas/techalerts/TA09-133A.htmlhttp://lists.apple.com/archives/security-announce/2009/May/msg00002.htmlhttp://secunia.com/advisories/35074http://support.apple.com/kb/HT3549http://www.redhat.com/support/errata/RHSA-2009-1062.htmlhttp://secunia.com/advisories/35200http://www.redhat.com/support/errata/RHSA-2009-1061.htmlhttp://secunia.com/advisories/35204http://www.redhat.com/support/errata/RHSA-2009-0329.htmlhttp://secunia.com/advisories/35198http://security.gentoo.org/glsa/glsa-200905-05.xmlhttp://secunia.com/advisories/35210http://lists.apple.com/archives/security-announce/2009/jun/msg00002.htmlhttp://www.vupen.com/english/advisories/2009/1522http://support.apple.com/kb/HT3613http://secunia.com/advisories/35379http://www.vupen.com/english/advisories/2009/1621http://support.apple.com/kb/HT3639http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.htmlhttp://sunsolve.sun.com/search/document.do?assetkey=1-66-270268-1http://www.mandriva.com/security/advisories?name=MDVSA-2009:243http://support.apple.com/kb/HT4435http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10149https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=524925https://usn.ubuntu.com/767-1/https://nvd.nist.gov
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
deserializationCVE-2024-4040cross-site scriptingCVE-2023-25790CVE-2024-2961XML external entityCVE-2024-26926CVE-2024-32806CVE-2024-32711
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook