Published: 06/03/2017 Updated: 26/01/2021

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

The parse_charstrings function in type1/t1load.c in FreeType 2 prior to 2.7 does not ensure that a font contains a glyph name, which allows remote malicious users to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
freetype freetype
debian debian linux 8.0

FreeType could be made to crash or run programs if it opened a specially crafted font file ...

Several vulnerabilities were discovered in Freetype Opening malformed fonts may result in denial of service or the execution of arbitrary code For the stable distribution (jessie), these problems have been fixed in version 252-3+deb8u2 We recommend that you upgrade your freetype packages ...

Debian Bug report logs - #856971 freetype: CVE-2016-10244 Package: src:freetype; Maintainer for src:freetype is Hugh McMaster <hughmcmaster@outlookcom>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 6 Mar 2017 19:24:01 UTC Severity: important Tags: patch, security, upstream Found in version fre ...

Debian Bug report logs - #861308 freetype: CVE-2017-8287: out-of-bounds write via t1_builder_close_contour function Package: src:freetype; Maintainer for src:freetype is Hugh McMaster <hughmcmaster@outlookcom>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 27 Apr 2017 09:21:01 UTC Severity: grave ...

Debian Bug report logs - #861220 freetype: CVE-2017-8105 Package: src:freetype; Maintainer for src:freetype is Hugh McMaster <hughmcmaster@outlookcom>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 26 Apr 2017 06:24:01 UTC Severity: grave Tags: patch, security, upstream Found in versions freetyp ...

The parse_charstrings function in type1/t1loadc in FreeType 2 before 27 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file ...

CWE-125 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/ChangeLog?h=VER-2-7 http://www.securityfocus.com/bid/97405 https://source.android.com/security/bulletin/2017-04-01 https://security.gentoo.org/glsa/201706-14 http://www.securitytracker.com/id/1038201 http://www.securitytracker.com/id/1038090 http://www.debian.org/security/2017/dsa-3839 https://www.oracle.com/security-alerts/cpuapr2020.html https://usn.ubuntu.com/3237-1/https://nvd.nist.gov

CVE-2016-10244

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect