PT-2022-1386 · Freetype+9 · Freetype+9

Published 2022-03-18 · Updated 2025-04-24 · CVE-2022-27405

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FreeType (affected versions not specified)

Description The issue is related to a segmentation violation via the FNT Size Request function, which can be exploited by a remote attacker to cause a denial of service. Additionally, there is a possible out of bounds read due to a missing bounds check in the ft open face internal function of ftobjs.c, potentially leading to remote information disclosure without requiring additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2022:7745

ALSA-2022:8340

ALT-PU-2022-1636

ALT-PU-2024-14219

ALT-PU-2024-8906

ASB-A-271680254

AZL-9580

BDU:2022-06917

CESA-2022_7745

CVE-2022-27405

INFSA-2022_8340

MGASA-2022-0184

OESA-2022-1655

OPENSUSE-SU-2022_3252-1

OPENSUSE-SU-2024:12395-1

RHSA-2022:7745

RHSA-2022:8340

RHSA-2022_7745

RHSA-2022_8340

RHSA-2024:0420

RLSA-2022:7745

RLSA-2022:8340

SUSE-SU-2022:3252-1

SUSE-SU-2022:3252-2

SUSE-SU-2025:20204-1

USN-5528-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Freetype

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

References · 93

• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-1121SE47 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-8340.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-27405 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27404 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:3252-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFPNRKDLCXHZVYYQLQMP44UHLU32GA6Z · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYVC2NPKKXKP3TWJWG4ONYWNO6ZPHLA5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27406 · Security Note
• https://osv.dev/vulnerability/MGASA-2022-0184 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-7745.html · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-271680254 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5528-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-27405 · Vendor Advisory
• https://gitlab.freedesktop.org/freetype/freetype/-/issues/1139 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-27404 · Vendor Advisory