PT-2010-1111 · Freetype+2 · Freetype+2
Jagger
+1
·
Publicado
2010-07-30
·
Atualizado
2023-02-13
·
CVE-2010-2519
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
FreeType versions prior to 2.4.0
FreeType versions prior to 2.4.8
Description
The issue is related to a heap-based buffer overflow in the Mac Read POST Resource function in base/ftobjs.c, which can be triggered by a crafted length value in a POST fragment header in a font file. This can cause a denial of service, such as an application crash, or possibly allow the execution of arbitrary code. The vulnerability can be exploited remotely.
Recommendations
For versions prior to 2.4.0, update to version 2.4.0 or later.
For versions prior to 2.4.8, update to version 2.4.8 or later.
As a temporary workaround, consider restricting access to font files or disabling the Mac Read POST Resource function until a patch is available.
Exploit
Correção
DoS
Buffer Overflow
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Freetype
Red Hat
Suse