Published: 08/02/2015 Updated: 30/10/2018

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType prior to 2.5.4 does not properly check for an integer overflow, which allows remote malicious users to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted OpenType font.

Vulnerable Product	Search on Vulmon	Subscribe to Product
fedoraproject fedora 20
fedoraproject fedora 21
freetype freetype
debian debian linux 7.0
opensuse opensuse 13.2
opensuse opensuse 13.1
canonical ubuntu linux 10.04
canonical ubuntu linux 15.04
canonical ubuntu linux 14.10
canonical ubuntu linux 14.04
canonical ubuntu linux 12.04

Debian Bug report logs - #777656 freetype: various new security issues Package: src:freetype; Maintainer for src:freetype is Hugh McMaster <hughmcmaster@outlookcom>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 11 Feb 2015 06:54:07 UTC Severity: grave Tags: fixed-upstream, security, upstream Fo ...

FreeType could be made to crash or run programs as your login if it opened a specially crafted file ...

Mateusz Jurczyk discovered multiple vulnerabilities in Freetype Opening malformed fonts may result in denial of service or the execution of arbitrary code For the stable distribution (wheezy), these problems have been fixed in version 249-11+deb7u1 For the upcoming stable distribution (jessie), these problems have been fixed in version 252- ...

CWE-119 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=f0292bb9920aa1dbfed5f53861e7c7a89b35833a http://code.google.com/p/google-security-research/issues/detail?id=196 http://www.ubuntu.com/usn/USN-2510-1 http://www.debian.org/security/2015/dsa-3188 http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150162.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:055 http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150148.html http://advisories.mageia.org/MGASA-2015-0083.html http://lists.opensuse.org/opensuse-updates/2015-03/msg00091.html http://www.ubuntu.com/usn/USN-2739-1 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.securityfocus.com/bid/72986 https://security.gentoo.org/glsa/201503-05 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777656 https://usn.ubuntu.com/2510-1/https://nvd.nist.gov

CVE-2014-9656

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect