PT-2014-4577 · Freetype+1 · Freetype+1

Mateusz Jurczyk · Publicado 2014-03-11 · Atualizado 2025-04-24 · CVE-2014-2241

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FreeType versions prior to 2.5.3

Description The issue is related to the cf2 initLocalRegionBuffer and cf2 initGlobalRegionBuffer functions in cff/cf2ft.c, which do not properly check if a subroutine exists. This allows remote attackers to cause a denial of service (assertion failure) by using a crafted ttf file.

Recommendations For versions prior to 2.5.3, update to version 2.5.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted ttf files to minimize the risk of exploitation.

Exploit

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2014-1274

CVE-2014-2241

MGASA-2014-0130

OPENSUSE-SU-2024:10438-1

SUSE-SU-2025:20204-1

Produtos afetados

Alt Linux

Freetype

Referências · 84

• 🔥 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=135c3faebb96f8f550bd4f318716f2e1e095a969 · Exploit
• https://suse.com/security/cve/CVE-2014-9664 · Nota
• https://suse.com/security/cve/CVE-2012-1141 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2025:20204-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2011-3256 · Nota
• https://suse.com/security/cve/CVE-2014-9671 · Nota
• https://bugzilla.suse.com/867620 · Nota
• https://suse.com/security/cve/CVE-2012-1127 · Nota
• https://suse.com/security/cve/CVE-2014-9670 · Nota
• https://suse.com/security/cve/CVE-2010-2497 · Nota
• https://suse.com/security/cve/CVE-2012-1128 · Nota
• https://suse.com/security/cve/CVE-2012-1130 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=12986 · Nota
• https://suse.com/security/cve/CVE-2010-3814 · Nota
• https://suse.com/security/cve/CVE-2012-1131 · Nota