PT-2010-1110 · Freetype+2 · Freetype+2
Jagger
+1
·
Publicado
2010-07-30
·
Atualizado
2023-02-13
·
CVE-2010-2500
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
FreeType versions prior to 2.4.0
FreeType versions prior to 2.4.8
Description
The issue is related to an integer overflow in the gray render span function in smooth/ftgrays.c, which allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted font file. Multiple vulnerabilities in the freetype package may lead to violations of confidentiality, integrity, and availability of protected information, and exploitation can be done remotely.
Recommendations
For versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue.
For versions prior to 2.4.8, update to version 2.4.8 or later to resolve the issue.
As a temporary workaround, consider restricting the use of crafted font files until a patch is available.
Correção
DoS
Buffer Overflow
Integer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Freetype
Red Hat
Suse