PT-2010-1118 · Freetype+1 · Freetype+1

Published 2010-08-19 · Updated 2024-06-15 · CVE-2010-3053

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeType versions prior to 2.4.2 FreeType versions prior to 2.4.8

Description The issue allows remote attackers to cause problems with the application, potentially leading to a denial of service, by using a specially crafted BDF font file. This is related to an attempted modification of a value in a static string. Multiple vulnerabilities in the FreeType package can lead to issues with confidentiality, integrity, and availability of protected information, and these can be exploited remotely.

Recommendations For versions prior to 2.4.2, update to version 2.4.2 or later. For versions prior to 2.4.8, update to version 2.4.8 or later.

Fix

DoS

Buffer Overflow

RCE

Weakness Enumeration

CWE-119

CWE-20

Related Identifiers

BDU:2015-09431

CVE-2010-3053

DSA-2105-1

OPENSUSE-SU-2024:10172-1

OPENSUSE-SU-2024:10438-1

Affected Products

Freetype

Suse

References · 75

• https://nvd.nist.gov/vuln/detail/CVE-2010-3053 · Security Note
• http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09431 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2010-3053 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-3053 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-3053 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10172-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10438-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html · Vendor Advisory
• https://bugs.launchpad.net/ubuntu/maverick/+source/freetype/+bug/617019 · Note
• https://suse.com/security/cve/CVE-2014-9670 · Note
• https://suse.com/security/cve/CVE-2012-1133 · Note
• https://suse.com/security/cve/CVE-2014-9668 · Note
• https://suse.com/security/cve/CVE-2014-9658 · Note