CVE-2016-10328

freetype: heap-based buffer overflow related to the cff_parser_run function

FreeType 2 before 2016-12-16 has an out-of-bounds write caused by a heap-based buffer overflow related to the cff_parser_run function in cff/cffparse.c.

CVSS 3.1 · 9.8 Critical EPSS 3.7% KEV · Not listed

Vendors

Freetype Oracle

Products

Freetype Outside In Technology

CVE-2017-8105

freetype: heap-based buffer overflow related to the t1_decoder_parse_charstrings

FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c.

CVSS 3.0 · 9.8 Critical EPSS 4.4% KEV · Not listed

Vendors

Debian Freetype

Products

Debian Linux Freetype

CVE-2017-8287

freetype: heap-based buffer overflow related to the t1_builder_close_contour function

FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c.

CVSS 3.0 · 9.8 Critical EPSS 3.6% KEV · Not listed

Vendors

Freetype

Products

Freetype

CVE-2017-7864

freetype: heap-based buffer overflow related to the tt_size_reset function

FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tt_size_reset function in truetype/ttobjs.c.

CVSS 3.0 · 9.8 Critical EPSS 3.8% KEV · Not listed

Vendors

Freetype

Products

Freetype

CVE-2014-9747

freetype: Use of uninitialized memory

The t42_parse_encoding function in type42/t42parse.c in FreeType before 2.5.4 does not properly update the current position for immediates-only mode, which allows remote attackers to cause a denial of service (infinite loop) via a Type42 font.

CVSS 3.0 · 7.5 High EPSS 3.0% KEV · Not listed

Vendors

Debian Freetype

Products

Debian Linux Freetype

CVE-2014-9745

freetype: Infinite loop in parse_encoding in t1load.c

The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a "broken number-with-base" in a Postscript stream, as demonstrated by 8#garbage.

CVSS 2.0 · 5.0 Medium EPSS 3.7% KEV · Not listed

Vendors

Canonical Debian Freetype and 1 more

Products

Ubuntu Linux Debian Linux Freetype and 1 more

CVE-2014-9746

freetype: Use of uninitialized memory

The (1) t1_parse_font_matrix function in type1/t1load.c, (2) cid_parse_font_matrix function in cid/cidload.c, (3) t42_parse_font_matrix function in type42/t42parse.c, and (4) ps_parser_load_field function in psaux/psobjs.c in FreeType before 2.5.4 do not check return values, which allows remote attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted font.

CVSS 3.0 · 9.8 Critical EPSS 3.3% KEV · Not listed

Vendors

Debian Freetype

Products

Debian Linux Freetype

CVE-2014-9673

freetype: integer signedness error in Mac_Read_POST_Resource() leading to heap-based buffer overflow

Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.

CVSS 2.0 · 6.8 Medium EPSS 3.4% KEV · Not listed

Vendors

Canonical Debian Freetype and 2 more

Products

Ubuntu Linux Debian Linux Freetype and 8 more

CVE-2014-9674

freetype: multiple integer overflows Mac_Read_POST_Resource() leading to heap-based buffer overflows

The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.

CVSS 2.0 · 7.5 High EPSS 5.7% KEV · Not listed

Vendors

Canonical Fedoraproject Freetype and 3 more

Products

Ubuntu Linux Fedora Freetype and 9 more

CVE-2014-9671

freetype: integer overflow in pcf_get_properties() leading to NULL pointer dereference

Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PCF file with a 0xffffffff size value that is improperly incremented.

CVSS 2.0 · 4.3 Medium EPSS 3.5% KEV · Not listed

Vendors

Canonical Debian Freetype and 3 more

Products

Ubuntu Linux Debian Linux Freetype and 9 more

CVE-2014-9672

freetype: Array index error in the parse_fond function in base/ftmac.c

Array index error in the parse_fond function in base/ftmac.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information from process memory via a crafted FOND resource in a Mac font file.

CVSS 2.0 · 5.8 Medium EPSS 4.7% KEV · Not listed

Vendors

Canonical Debian Freetype and 2 more

Products

Ubuntu Linux Debian Linux Freetype and 2 more

CVE-2014-9675

freetype: information leak in _bdf_add_property()

bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font.

CVSS 2.0 · 5.0 Medium EPSS 4.2% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 9 more

CVE-2014-9667

freetype: integer overflow in tt_face_load_font_dir() leading to out-of-bounds read

sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted SFNT table.

CVSS 2.0 · 6.8 Medium EPSS 3.5% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 9 more

CVE-2014-9668

freetype: integer overflow in woff_open_font() leading to heap-based buffer overflow

The woff_open_font function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting length values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Web Open Font Format (WOFF) file.

CVSS 2.0 · 7.5 High EPSS 1.9% KEV · Not listed

Vendors

Canonical Fedoraproject Freetype and 1 more

Products

Ubuntu Linux Fedora Freetype and 1 more

CVE-2014-9665

freetype: integer overflow leading to heap-based buffer overflow in Load_SBit_Png()

The Load_SBit_Png function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact by embedding a PNG file in a .ttf font file.

CVSS 2.0 · 7.5 High EPSS 4.9% KEV · Not listed

Vendors

Canonical Fedoraproject Freetype and 1 more

Products

Ubuntu Linux Fedora Freetype and 1 more

CVE-2014-9666

freetype: integer overflow in tt_sbit_decoder_init() leading to out-of-bounds read

The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted embedded bitmap.

CVSS 2.0 · 6.8 Medium EPSS 4.2% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 9 more

CVE-2014-9669

freetype: multiple integer overflows leading to buffer over-reads in cmap handling

Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have unspecified other impact via a crafted cmap SFNT table.

CVSS 2.0 · 6.8 Medium EPSS 3.9% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 10 more

CVE-2014-9661

freetype: out of bounds read in Type42 font parser

type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font.

CVSS 2.0 · 7.5 High EPSS 4.4% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 9 more

CVE-2014-9660

freetype: missing ENDCHAR NULL pointer dereference in the _bdf_parse_glyphs()

The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 10 more

CVE-2014-9662

freetype: heap-based buffer overflow in cff/cf2ft.c

cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted OTF font.

CVSS 2.0 · 7.5 High EPSS 4.3% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 2 more

Products

Ubuntu Linux Debian Linux Fedora and 2 more