PT-2011-5221 · Freetype+2 · Freetype2+2

Nirankush Panchbhai · Published 1970-01-01 · Updated 2024-06-15 · CVE-2011-3256

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions freetype2 versions prior to 2.4.8 freetype2-devel versions prior to 2.4.8 freetype2-devel-32bit versions prior to 2.4.8 freetype2-devel-64bit versions prior to 2.4.8 freetype2-32bit versions prior to 2.4.8 freetype2-64bit versions prior to 2.4.8

Description The issue concerns multiple vulnerabilities in the freetype2 package, which can lead to a breach of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely, potentially allowing attackers to execute arbitrary code or cause a denial of service due to memory corruption. This can be achieved via a crafted font.

Recommendations For freetype2 versions prior to 2.4.8, update to version 2.4.8 or later. For freetype2-devel versions prior to 2.4.8, update to version 2.4.8 or later. For freetype2-devel-32bit versions prior to 2.4.8, update to version 2.4.8 or later. For freetype2-devel-64bit versions prior to 2.4.8, update to version 2.4.8 or later. For freetype2-32bit versions prior to 2.4.8, update to version 2.4.8 or later. For freetype2-64bit versions prior to 2.4.8, update to version 2.4.8 or later.

Fix

DoS

RCE

Buffer Overflow

Code Injection

Weakness Enumeration

CWE-119

CWE-94

Related Identifiers

BDU:2015-04433

BDU:2015-04434

BDU:2015-04435

BDU:2015-04436

BDU:2015-04652

BDU:2015-04653

BDU:2015-09431

CVE-2011-3256

DSA-2328-1

OPENSUSE-SU-2012_0015-1

OPENSUSE-SU-2012_0047-1

OPENSUSE-SU-2024:10438-1

RHSA-2011:1402

RHSA-2011_1402

RHSA-2012:0094

Affected Products

Red Hat

Suse

Freetype2

References · 91

• https://bdu.fstec.ru/vul/2015-04433 · Security Note
• https://linux.oracle.com/errata/ELSA-2011-1402.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04653 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00012.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-3256 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-3256 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00008.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04434 · Security Note
• http://debian.org/security/2011/dsa-2328 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09431 · Security Note
• https://bdu.fstec.ru/vul/2015-04436 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2011:157 · Vendor Advisory
• http://support.apple.com/kb/HT4999 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-3256 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00003.html · Vendor Advisory