CVE-2014-9660

freetype: missing ENDCHAR NULL pointer dereference in the _bdf_parse_glyphs()

Published Feb 8, 2015 CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed
Description
The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-185-1 freetype security update
Debian DSA Debian DSA DSA-3188-1 freetype security update
EUVD EUVD EUVD-2014-9470 The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font.
Ubuntu USN Ubuntu USN USN-2510-1 FreeType vulnerabilities
History

No history.