PT-2010-1120 · Freetype+3 · Freetype+3

Publicado

2010-11-16

·

Atualizado

2024-06-15

·

CVE-2010-3855

CVSS v2.0

9.3

Alta

VetorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions FreeType versions prior to 2.4.8
Description The issue affects the FreeType package in Gentoo Linux, potentially leading to breaches in confidentiality, integrity, and availability of protected information. Exploitation can occur remotely. A buffer overflow in the ft var readpackedpoints function in truetype/ttgxvar.c allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted TrueType GX font.
Recommendations For versions prior to 2.4.8, update to version 2.4.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted TrueType GX fonts to minimize the risk of exploitation.

Correção

DoS

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2015-09431
CVE-2010-3855
DSA-2155-1
OPENSUSE-SU-2024:10438-1
RHSA-2010:0889
RHSA-2010_0889

Produtos afetados

Freetype
Gentoo Linux
Red Hat
Suse