PT-2008-1132 · Freetype+1 · Freetype+1
Publicado
2008-06-16
·
Atualizado
2018-10-11
·
CVE-2008-1807
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
freetype versions prior to 2.3.6
Description
The issue concerns multiple vulnerabilities in the freetype package that can be exploited to compromise the confidentiality, integrity, and availability of protected information. Exploitation can be achieved remotely. Specifically, it allows context-dependent attackers to execute arbitrary code via an invalid
number of axes field in a Printer Font Binary (PFB) file, leading to memory corruption by freeing arbitrary memory locations.Recommendations
For versions prior to 2.3.6, update to version 2.3.6 or later to resolve the issue. As a temporary workaround, consider restricting the use of freetype until a patch is applied. Avoid using freetype to process untrusted PFB files until the issue is resolved.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Red Hat
Freetype