PT-2012-6348 · Freetype+3 · Libfreetype6-Debuginfo-X86+13

Mateusz Jurczyk · Published 1970-01-01 · Updated 2024-06-15 · CVE-2012-1137

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions freetype versions prior to 2.4.9 libfreetype6 versions prior to 2.4.9 libfreetype6-32bit versions prior to 2.4.9 libfreetype6-debuginfo versions prior to 2.4.9 libfreetype6-debuginfo-32bit versions prior to 2.4.9 libfreetype6-debuginfo-x86 versions prior to 2.4.9 libfreetype6-x86 versions prior to 2.4.9 freetype2-devel versions prior to 2.4.9 freetype2-devel-32bit versions prior to 2.4.9 ft2demos versions prior to 2.4.9 freetype2-debugsource versions prior to 2.4.9

Description The issue is related to multiple vulnerabilities in the freetype package, which can lead to a disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely, potentially causing a denial of service or allowing the execution of arbitrary code via a crafted header in a BDF font.

Recommendations For freetype versions prior to 2.4.9, update to version 2.4.9 or later. For libfreetype6 versions prior to 2.4.9, update to version 2.4.9 or later. For libfreetype6-32bit versions prior to 2.4.9, update to version 2.4.9 or later. For libfreetype6-debuginfo versions prior to 2.4.9, update to version 2.4.9 or later. For libfreetype6-debuginfo-32bit versions prior to 2.4.9, update to version 2.4.9 or later. For libfreetype6-debuginfo-x86 versions prior to 2.4.9, update to version 2.4.9 or later. For libfreetype6-x86 versions prior to 2.4.9, update to version 2.4.9 or later. For freetype2-devel versions prior to 2.4.9, update to version 2.4.9 or later. For freetype2-devel-32bit versions prior to 2.4.9, update to version 2.4.9 or later. For ft2demos versions prior to 2.4.9, update to version 2.4.9 or later. For freetype2-debugsource versions prior to 2.4.9, update to version 2.4.9 or later.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-04507

BDU:2015-05454

BDU:2015-05455

BDU:2015-05456

BDU:2015-05457

BDU:2015-05458

BDU:2015-05459

BDU:2015-05460

BDU:2015-05461

BDU:2015-05462

BDU:2015-09663

CESA-2012_0467

CVE-2012-1137

OPENSUSE-SU-2024:10438-1

RHSA-2012:0467

RHSA-2012_0467

Affected Products

Centos

Red Hat

Suse

Freetype

Freetype2-Debugsource

Freetype2-Devel

Freetype2-Devel-32Bit

Ft2Demos

Libfreetype6

Libfreetype6-32Bit

Libfreetype6-Debuginfo

Libfreetype6-Debuginfo-32Bit

Libfreetype6-Debuginfo-X86

Libfreetype6-X86

References · 127

• http://ubuntu.com/usn/USN-1403-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-1137 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1134 · Security Note
• https://bdu.fstec.ru/vul/2015-05456 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00004.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00002.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1141 · Security Note
• http://security.gentoo.org/glsa/glsa-201204-04.xml · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1130 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2012:057 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-05458 · Security Note
• https://bdu.fstec.ru/vul/2015-05460 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2012-1137 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-05457 · Security Note