PT-2010-1114 · Freetype+2 · Freetype+2

Josh Bressers + 1 · Published 2010-07-30 · Updated 2021-04-06 · CVE-2010-2541

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeType versions prior to 2.4.2 FreeType versions prior to 2.4.8

Description The issue is related to a buffer overflow in the ftmulti demo program, which can be triggered by a crafted font file. This can cause a denial of service, resulting in an application crash, or potentially allow the execution of arbitrary code. Additionally, there are multiple vulnerabilities in the FreeType package that can lead to breaches of confidentiality, integrity, and availability of protected information, and these can be exploited remotely.

Recommendations For versions prior to 2.4.2, update to version 2.4.2 or later. For versions prior to 2.4.8, update to version 2.4.8 or later.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

BDU:2015-09431

CVE-2010-2541

DSA-2105-1

RHSA-2010:0577

RHSA-2010:0578

RHSA-2010_0578

Affected Products

Freetype

Red Hat

Suse

References · 27

• http://ubuntu.com/usn/USN-972-1 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0577.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=617342 · Patch
• https://security-tracker.debian.org/tracker/CVE-2010-2541 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09431 · Security Note
• http://redhat.com/support/errata/RHSA-2010-0578.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-2541 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2541 · Security Note
• https://osv.dev/vulnerability/CVE-2010-2541 · Vendor Advisory
• http://sourceforge.net/projects/freetype/files/freetype2/2.4.2/NEWS/view · Note
• https://bugs.launchpad.net/ubuntu/maverick/+source/freetype/+bug/617019 · Note
• https://savannah.nongnu.org/bugs/?30248 · Note
• http://secunia.com/advisories/48951 · Note
• https://access.redhat.com/security/cve/CVE-2010-2527 · Note
• https://savannah.nongnu.org/bugs/?30306 · Note