PT-2010-1109 · Freetype+2 · Freetype+2
Jagger
+1
·
Published
2010-07-30
·
Updated
2021-04-06
·
CVE-2010-2499
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
FreeType versions prior to 2.4.8
FreeType versions prior to 2.4.0
Description
The issue concerns multiple vulnerabilities in the FreeType package, which can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. A buffer overflow in the
Mac Read POST Resource function in base/ftobjs.c allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted LaserWriter PS font file with an embedded PFB fragment.Recommendations
For FreeType versions prior to 2.4.8, update to version 2.4.8 or later to resolve the issue.
For FreeType versions prior to 2.4.0, update to version 2.4.0 or later to address the buffer overflow vulnerability in the
Mac Read POST Resource function.
As a temporary workaround, consider restricting the use of crafted LaserWriter PS font files to minimize the risk of exploitation.Exploit
Fix
DoS
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Freetype
Red Hat
Suse