PT-2010-1052 · Freetype+2 · Freetype+2
Jan Lieskovsky
+1
·
Publicado
2010-10-04
·
Atualizado
2024-06-15
·
CVE-2010-3311
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
FreeType versions prior to 2.4
Description
The issue is related to an integer overflow in the base/ftstream.c file of the libXft library in FreeType, which can be triggered by a crafted Compact Font Format (CFF) font file. This can cause a denial of service (application crash) or possibly allow the execution of arbitrary code due to a heap-based buffer overflow. The vulnerability can be exploited remotely.
Recommendations
For FreeType versions prior to 2.4, update to version 2.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted CFF font files to minimize the risk of exploitation.
Correção
DoS
Buffer Overflow
Improper Validation of Array Index
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Freetype
Red Hat
Suse