PT-2010-1051 · Freetype+2 · Freetype+2
Published
2010-08-19
·
Updated
2024-06-15
·
CVE-2010-3054
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
freetype versions prior to 2.4.8
freetype versions prior to 2.4.2
Description
The issue concerns multiple vulnerabilities in the freetype package, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. The vulnerabilities can lead to a denial of service via vectors involving nested Standard Encoding Accented Character (seac) calls, related to files such as psaux.h, cffgload.c, cffgload.h, and t1decode.c.
Recommendations
For versions prior to 2.4.2, update to version 2.4.2 or later.
For versions prior to 2.4.8, update to version 2.4.8 or later.
As a temporary workaround, consider restricting access to the freetype package until a patch is available.
Fix
Buffer Overflow
Improper Validation of Array Index
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Red Hat
Suse
Freetype