PT-2013-1223 · Freetype+1 · Freetype+1

J00Ru + 1 · Published 2013-01-24 · Updated 2024-06-15 · CVE-2012-5668

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions FreeType versions prior to 2.4.11

Description The issue allows context-dependent attackers to cause a denial of service, resulting in a crash due to a NULL pointer dereference. This is related to the improper handling of an "allocation error" in the bdf free font function when dealing with BDF fonts. The vulnerability can be exploited remotely, potentially leading to a disruption in the availability of protected information.

Recommendations For versions prior to 2.4.11, update to version 2.4.11 or later to resolve the issue. As a temporary workaround, consider restricting the use of BDF fonts until a patch is available.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-09722

CVE-2012-5668

OPENSUSE-SU-2024:10172-1

OPENSUSE-SU-2024:10438-1

SUSE-SU-2013_0195-1

SUSE-SU-2013_0196-1

Affected Products

Freetype

Suse

References · 87

• https://bdu.fstec.ru/vul/2015-09722 · Security Note
• http://ubuntu.com/usn/USN-1686-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-5668 · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.520186 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5669 · Security Note
• http://lists.opensuse.org/opensuse-updates/2013-01/msg00056.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08926 · Security Note
• http://secunia.com/advisories/51826 · Vendor Advisory
• http://secunia.com/advisories/51900 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-5668 · Security Note
• http://lists.opensuse.org/opensuse-updates/2013-01/msg00078.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-5668 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10172-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10438-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-5668 · Vendor Advisory