PT-2017-17958 · Freetype+1 · Freetype+1

CVE-2017-7857

·

Publicado

2017-04-14

·

Atualizado

2024-07-24

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions FreeType 2 versions prior to 2017-03-08
Description The issue is caused by a heap-based buffer overflow related to the TT Get MM Var function in truetype/ttgxvar.c and the sfnt init face function in sfnt/sfobjs.c, resulting in an out-of-bounds write.
Recommendations For versions prior to 2017-03-08, update to a version released after 2017-03-08 to resolve the issue. As a temporary workaround, consider restricting access to the TT Get MM Var and sfnt init face functions until a patch is available.

Correção

Memory Corruption

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

ALT-PU-2017-2190
CVE-2017-7857

Produtos afetados

Alt Linux
Freetype