PT-2010-1109 · Freetype+2 · Freetype+2
Jagger
+1
·
Publicado
2010-07-30
·
Atualizado
2021-04-06
·
CVE-2010-2499
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
FreeType versions prior to 2.4.8
FreeType versions prior to 2.4.0
Description
The issue concerns multiple vulnerabilities in the FreeType package, which can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. A buffer overflow in the
Mac Read POST Resource function in base/ftobjs.c allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted LaserWriter PS font file with an embedded PFB fragment.Recommendations
For FreeType versions prior to 2.4.8, update to version 2.4.8 or later to resolve the issue.
For FreeType versions prior to 2.4.0, update to version 2.4.0 or later to address the buffer overflow vulnerability in the
Mac Read POST Resource function.
As a temporary workaround, consider restricting the use of crafted LaserWriter PS font files to minimize the risk of exploitation.Exploit
Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Freetype
Red Hat
Suse