PT-2022-5554 · Freetype+9 · Freetype+9

Frokaikan · Published 2022-03-17 · Updated 2025-04-24 · CVE-2022-27404

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeType (affected versions not specified)

Description The issue is related to a heap buffer overflow via the sfnt init face function. This allows a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The problem was identified in a specific commit of the FreeType library.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALSA-2022:7745

ALSA-2022:8340

ALT-PU-2022-1636

ALT-PU-2024-14219

ALT-PU-2024-8906

AZL-26757

AZL-9573

BDU:2022-06908

CESA-2022_7745

CVE-2022-27404

INFSA-2022_8340

MGASA-2022-0184

OESA-2022-1655

OPENSUSE-SU-2022_3252-1

OPENSUSE-SU-2024:12279-1

OPENSUSE-SU-2024:12367-1

OPENSUSE-SU-2024:12395-1

RHSA-2022:7745

RHSA-2022:8340

RHSA-2022_7745

RHSA-2022_8340

RHSA-2024:0420

RLSA-2022:7745

RLSA-2022:8340

SUSE-SU-2022:3252-1

SUSE-SU-2022:3252-2

SUSE-SU-2022_3252-1

SUSE-SU-2022_3252-2

SUSE-SU-2025:20204-1

USN-5528-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Freetype

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

References · 91

• 🔥 https://gitlab.freedesktop.org/freetype/freetype/-/issues/1138 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:12367-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-27404 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-1121SE47 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-8340.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27404 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:3252-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFPNRKDLCXHZVYYQLQMP44UHLU32GA6Z · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYVC2NPKKXKP3TWJWG4ONYWNO6ZPHLA5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27406 · Security Note
• https://osv.dev/vulnerability/MGASA-2022-0184 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-27404 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-7745.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5528-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-9573 · Vendor Advisory