PT-2010-1115 · Freetype+2 · Freetype+2
Published
2010-08-19
·
Updated
2024-06-15
·
CVE-2010-2805
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
FreeType versions prior to 2.4.8
FreeType versions prior to 2.4.2
Description
The issue concerns multiple vulnerabilities in the FreeType package, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. Specifically, the FT Stream EnterFrame function in base/ftstream.c does not properly validate certain position values, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted font file.
Recommendations
For versions prior to 2.4.2, consider updating to version 2.4.2 or later to resolve the issue.
For versions prior to 2.4.8, consider updating to version 2.4.8 or later to resolve the issue.
As a temporary workaround, consider restricting the use of crafted font files to minimize the risk of exploitation.
Exploit
Fix
DoS
Buffer Overflow
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Freetype
Red Hat
Suse