Published: 08/02/2015 Updated: 30/10/2018

CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6

VMScore: 516

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:P

Array index error in the parse_fond function in base/ftmac.c in FreeType prior to 2.5.4 allows remote malicious users to cause a denial of service (out-of-bounds read) or obtain sensitive information from process memory via a crafted FOND resource in a Mac font file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
oracle solaris 11.2
oracle solaris 10.0
debian debian linux 7.0
canonical ubuntu linux 15.04
canonical ubuntu linux 14.10
canonical ubuntu linux 14.04
canonical ubuntu linux 12.04
canonical ubuntu linux 10.04
freetype freetype
opensuse opensuse 13.2
opensuse opensuse 13.1

Debian Bug report logs - #777656 freetype: various new security issues Package: src:freetype; Maintainer for src:freetype is Hugh McMaster <hughmcmaster@outlookcom>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 11 Feb 2015 06:54:07 UTC Severity: grave Tags: fixed-upstream, security, upstream Fo ...

FreeType could be made to crash or run programs as your login if it opened a specially crafted file ...

Mateusz Jurczyk discovered multiple vulnerabilities in Freetype Opening malformed fonts may result in denial of service or the execution of arbitrary code For the stable distribution (wheezy), these problems have been fixed in version 249-11+deb7u1 For the upcoming stable distribution (jessie), these problems have been fixed in version 252- ...

CWE-119 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=18a8f0d9943369449bc4de92d411c78fb08d616c http://code.google.com/p/google-security-research/issues/detail?id=155 http://www.ubuntu.com/usn/USN-2510-1 http://www.debian.org/security/2015/dsa-3188 http://www.mandriva.com/security/advisories?name=MDVSA-2015:055 http://advisories.mageia.org/MGASA-2015-0083.html http://lists.opensuse.org/opensuse-updates/2015-03/msg00091.html http://www.ubuntu.com/usn/USN-2739-1 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://packetstormsecurity.com/files/134395/FreeType-2.5.3-Mac-FOND-Resource-Parsing-Out-Of-Bounds-Read-From-Stack.html http://www.securityfocus.com/bid/72986 https://security.gentoo.org/glsa/201503-05 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777656 https://usn.ubuntu.com/2510-1/https://nvd.nist.gov

CVE-2014-9672

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect