PT-2014-4577 · Freetype+1 · Freetype+1

Mateusz Jurczyk · Published 2014-03-11 · Updated 2025-04-24 · CVE-2014-2241

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FreeType versions prior to 2.5.3

Description The issue is related to the cf2 initLocalRegionBuffer and cf2 initGlobalRegionBuffer functions in cff/cf2ft.c, which do not properly check if a subroutine exists. This allows remote attackers to cause a denial of service (assertion failure) by using a crafted ttf file.

Recommendations For versions prior to 2.5.3, update to version 2.5.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted ttf files to minimize the risk of exploitation.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2014-1274

CVE-2014-2241

MGASA-2014-0130

OPENSUSE-SU-2024:10438-1

SUSE-SU-2025:20204-1

Affected Products

Alt Linux

Freetype

References · 84

• 🔥 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=135c3faebb96f8f550bd4f318716f2e1e095a969 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2025:20204-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-2241 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-2241 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2241 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-2241 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0130 · Vendor Advisory
• http://ubuntu.com/usn/USN-2148-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0130.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10438-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2014-9664 · Note
• https://suse.com/security/cve/CVE-2012-1141 · Note
• https://suse.com/security/cve/CVE-2011-3256 · Note
• https://suse.com/security/cve/CVE-2014-9671 · Note
• https://bugzilla.suse.com/867620 · Note