4.3
CVSSv2

CVE-2012-5670

Published: 24/01/2013 Updated: 26/01/2021
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
VMScore: 383
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Vulnerability Summary

The _bdf_parse_glyphs function in FreeType prior to 2.4.11 allows context-dependent malicious users to cause a denial of service (out-of-bounds write and crash) via vectors related to BDF fonts and an ENCODING field with a negative value.

Vulnerable Product Search on Vulmon Subscribe to Product

freetype freetype 2.4.4

freetype freetype 2.4.8

freetype freetype 2.3.8

freetype freetype 2.3.7

freetype freetype 2.3.1

freetype freetype 2.3.0

freetype freetype 2.1.8

freetype freetype 2.1.3

freetype freetype 2.0.5

freetype freetype 2.0.7

freetype freetype 1.3.1

freetype freetype 2.4.3

freetype freetype 2.4.0

freetype freetype 2.3.3

freetype freetype 2.3.9

freetype freetype 2.3.11

freetype freetype 2.3.10

freetype freetype 2.1.6

freetype freetype 2.0.3

freetype freetype 2.0.4

freetype freetype 2.0.9

freetype freetype 2.0.6

freetype freetype

freetype freetype 2.4.5

freetype freetype 2.4.6

freetype freetype 2.3.4

freetype freetype 2.3.5

freetype freetype 2.3.12

freetype freetype 2.1.9

freetype freetype 2.1.7

freetype freetype 2.1.4

freetype freetype 2.1

freetype freetype 2.0.2

freetype freetype 2.0.8

freetype freetype 2.4.9

freetype freetype 2.4.7

freetype freetype 2.4.1

freetype freetype 2.4.2

freetype freetype 2.3.6

freetype freetype 2.3.2

freetype freetype 2.2.0

freetype freetype 2.2.1

freetype freetype 2.1.10

freetype freetype 2.1.5

freetype freetype 2.0.0

freetype freetype 2.0.1

Vendor Advisories

Debian Bug report logs - #696691 freetype: multiple vulnerabilities in freetype before 2411 Package: src:freetype; Maintainer for src:freetype is Hugh McMaster <hughmcmaster@outlookcom>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 25 Dec 2012 23:36:01 UTC Severity: grave Tags: patch, security ...
FreeType could be made to crash or run programs as your login if it opened a specially crafted file ...