PT-2022-5552 · Freetype+9 · Freetype+9

Published 2022-03-19 · Updated 2025-04-24 · CVE-2022-27406

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FreeType (affected versions not specified)

Description The issue is related to a function FT Request Size in the FreeType library, which is associated with reading beyond the allowed boundaries of a data buffer. This can be exploited by a remote attacker to cause a denial of service. The problem was discovered in a specific commit of FreeType, identified as 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5, where a segmentation violation occurs via the FT Request Size function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2022:7745

ALSA-2022:8340

ALT-PU-2022-1636

ALT-PU-2024-14219

ALT-PU-2024-8906

AZL-26759

AZL-9581

BDU:2022-06905

CESA-2022_7745

CVE-2022-27406

INFSA-2022_8340

MGASA-2022-0184

OESA-2022-1655

OPENSUSE-SU-2022_3252-1

OPENSUSE-SU-2024:12279-1

OPENSUSE-SU-2024:12395-1

RHSA-2022:7745

RHSA-2022:8340

RHSA-2022_7745

RHSA-2022_8340

RHSA-2024:0420

RLSA-2022:7745

RLSA-2022:8340

SUSE-SU-2022:3252-1

SUSE-SU-2022:3252-2

SUSE-SU-2025:20204-1

USN-5453-1

USN-5528-1

USN-7352-2

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Freetype

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

References · 96

• 🔥 https://gitlab.freedesktop.org/freetype/freetype/-/issues/1140 · Exploit
• https://osv.dev/vulnerability/USN-7352-2 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-1121SE47 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-8340.html · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-27406 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27406 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-27404 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:3252-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFPNRKDLCXHZVYYQLQMP44UHLU32GA6Z · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYVC2NPKKXKP3TWJWG4ONYWNO6ZPHLA5 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0184 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-27363 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-7745.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06905 · Security Note
• https://ubuntu.com/security/notices/USN-5528-1 · Vendor Advisory