Jagger

**Name of the Vulnerable Software and Affected Versions** FreeType versions prior to 2.4.0 FreeType versions prior to 2.4.8 **Description** The issue is related to an integer underflow in glyph handling, which can be exploited by remote attackers using a crafted font file. This can lead to a denial of service, causing the application to crash, or possibly allow the execution of arbitrary code. The vulnerability can be exploited remotely and may compromise the confidentiality, integrity, and availability of protected information. **Recommendations** For FreeType versions prior to 2.4.0, update to version 2.4.0 or later. For FreeType versions prior to 2.4.8, update to version 2.4.8 or later. As a temporary workaround, consider restricting the use of crafted font files until a patch is available.

**Name of the Vulnerable Software and Affected Versions** freetype versions prior to 2.4.8 **Description** The issue concerns multiple vulnerabilities in the freetype package that can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. A heap-based buffer overflow in the `Ins IUP` function in `truetype/ttinterp.c` can occur when TrueType bytecode support is enabled, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted font file. **Recommendations** For versions prior to 2.4.8, update to version 2.4.8 or later to resolve the issue. As a temporary workaround, consider disabling TrueType bytecode support until a patch is available. Restrict access to font files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FreeType versions prior to 2.4.8 FreeType versions prior to 2.4.2 **Description** The issue is related to multiple vulnerabilities in the FreeType package, which can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, FreeType before version 2.4.2 uses incorrect integer data types during bounds checking. This can allow remote attackers to cause a denial of service, such as an application crash, or possibly execute arbitrary code via a crafted font file. **Recommendations** For versions prior to 2.4.2, update to version 2.4.2 or later to resolve the issue. For versions prior to 2.4.8, update to version 2.4.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted font files until a patch is available.

**Name of the Vulnerable Software and Affected Versions** freetype versions prior to 2.4.8 freetype versions prior to 2.4.2 **Description** The issue affects the freetype package in Gentoo Linux, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Exploitation can occur remotely. A buffer overflow in the `Mac Read POST Resource` function in `base/ftobjs.c` allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted Adobe Type 1 Mac Font File. **Recommendations** For versions prior to 2.4.2, consider updating to version 2.4.2 or later to resolve the buffer overflow issue in the `Mac Read POST Resource` function. For versions prior to 2.4.8, update to version 2.4.8 or later to address the multiple vulnerabilities. As a temporary workaround, consider restricting the use of crafted Adobe Type 1 Mac Font Files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FreeType versions prior to 2.4.0 FreeType versions prior to 2.4.8 **Description** The issue is related to a heap-based buffer overflow in the Mac Read POST Resource function in base/ftobjs.c, which can be triggered by a crafted length value in a POST fragment header in a font file. This can cause a denial of service, such as an application crash, or possibly allow the execution of arbitrary code. The vulnerability can be exploited remotely. **Recommendations** For versions prior to 2.4.0, update to version 2.4.0 or later. For versions prior to 2.4.8, update to version 2.4.8 or later. As a temporary workaround, consider restricting access to font files or disabling the Mac Read POST Resource function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** freetype versions prior to 2.4.8 freetype versions prior to 2.4.0 **Description** The issue concerns multiple vulnerabilities in the freetype package, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. Specifically, the `psh glyph find strong points` function in `pshinter/pshalgo.c` does not properly implement hinting masks, allowing remote attackers to cause a denial of service, such as heap memory corruption and application crash, or possibly execute arbitrary code via a crafted font file that triggers an invalid free operation. **Recommendations** For versions prior to 2.4.0, consider updating to version 2.4.0 or later to address the issue with the `psh glyph find strong points` function. For versions prior to 2.4.8, update to version 2.4.8 or later to resolve the multiple vulnerabilities in the freetype package. As a temporary workaround, consider restricting the use of crafted font files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FreeType versions prior to 2.4.8 FreeType versions prior to 2.4.0 **Description** The issue concerns multiple vulnerabilities in the FreeType package, which can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. A buffer overflow in the `Mac Read POST Resource` function in `base/ftobjs.c` allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted LaserWriter PS font file with an embedded PFB fragment. **Recommendations** For FreeType versions prior to 2.4.8, update to version 2.4.8 or later to resolve the issue. For FreeType versions prior to 2.4.0, update to version 2.4.0 or later to address the buffer overflow vulnerability in the `Mac Read POST Resource` function. As a temporary workaround, consider restricting the use of crafted LaserWriter PS font files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FreeType versions prior to 2.4.0 FreeType versions prior to 2.4.8 **Description** The issue is related to an integer overflow in the gray render span function in smooth/ftgrays.c, which allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted font file. Multiple vulnerabilities in the freetype package may lead to violations of confidentiality, integrity, and availability of protected information, and exploitation can be done remotely. **Recommendations** For versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue. For versions prior to 2.4.8, update to version 2.4.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted font files until a patch is available.