CVSS: 4.3EPSS: 2%CPEs: 24EXPL: 1CVE-2014-9670 – freetype: integer overflow in pcf_get_encodings() leading to NULL pointer dereference
https://notcve.org/view.php?id=CVE-2014-9670
Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer overflow, NULL pointer dereference, and application crash) via a crafted PCF file that specifies negative values for the first column and first row. Múltiples erroes de signo de enteros en la función pcf_get_encodings en pcf/pcfread.c en FreeType anterior a 2.5.4 permiten a atacantes remotos causar una denegación de servicio (desbordamiento de enteros, referencia a puntero nulo y caída de aplicación) a través de un fichero PCF manipulado que especifica valores negativos para la primera columna y la primera fila. • http://advisories.mageia.org/MGASA-2015-0083.html http://code.google.com/p/google-security-research/issues/detail?id=158 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=ef1eba75187adfac750f326b563fe543dd5ff4e6 http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150148.html http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150162.html http://lists.opensuse.org/opensuse-updates/2015-03/msg00091.html http://rhn.redhat.com/errata/RHSA-2015-0696.html • CWE-189: Numeric Errors CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 4%CPEs: 22EXPL: 1CVE-2014-9661 – freetype: out of bounds read in Type42 font parser
https://notcve.org/view.php?id=CVE-2014-9661
type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font. type42/t42parse.c en FreeType anterior a 2.5.4 no considera que escaneo puede resultar incompleto sin provoca un error, lo que permite a atacantes remotos causar una denegación de servicio (uso después de liberación) o posiblemente tener otro impacto no especificado a través de una fuente Type42 manipulada. A use-after-free condition has been encountered in FreeType while fuzzing Type42 fonts. Version 2.5.3 is affected. • http://advisories.mageia.org/MGASA-2015-0083.html http://code.google.com/p/google-security-research/issues/detail?id=187 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=3788187e0c396952cd7d905c6c61f3ff8e84b2b4 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=42fcd6693ec7bd6ffc65ddc63e74287a65dda669 http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150148.html http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150162.html http://lists.opensuse& • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 3%CPEs: 12EXPL: 1CVE-2014-9659
https://notcve.org/view.php?id=CVE-2014-9659
cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint mask has been computed, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted OpenType font. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2240. cff/cf2intrp.c en el interprete CFF CharString en FreeType anterior a 2.5.4 proceda con indicios (hints) adicionales después de que la mascara de indicios (hints) haya sido computado, lo que permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (desbordamiento de buffere basado en pila) a través de una fuente OpenType manipulada. NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2014-2240. • http://code.google.com/p/google-security-research/issues/detail?id=190 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=2cdc4562f873237f1c77d43540537c7a721d3fd8 http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150148.html http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150162.html http://lists.opensuse.org/opensuse-updates/2015-03/msg00091.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.ubuntu.com/usn/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 1%CPEs: 4EXPL: 1CVE-2014-2241
https://notcve.org/view.php?id=CVE-2014-2241
The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service (assertion failure), as demonstrated by a crafted ttf file. Las funciones (1) cf2_initLocalRegionBuffer y (2) cf2_initGlobalRegionBuffer en cff/cf2ft.c en FreeType anterior a 2.5.3 no comprueban debidamente si una subrutina existe, lo que permite a atacantes remotos causar una denegación de servicio (fallo de aserción), tal y como fue demostrado por un archivo ttf manipulado. • http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=135c3faebb96f8f550bd4f318716f2e1e095a969 http://savannah.nongnu.org/bugs/?41697 http://secunia.com/advisories/57447 http://www.openwall.com/lists/oss-security/2014/03/12/4 http://www.ubuntu.com/usn/USN-2148-1 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 13%CPEs: 52EXPL: 0CVE-2014-2240
https://notcve.org/view.php?id=CVE-2014-2240
Stack-based buffer overflow in the cf2_hintmap_build function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of stem hints in a font file. Desbordamiento de buffer basado en pila en la función cf2_hintmap_build en cff/cf2hints.c en FreeType anterior a 2.5.3 permite a atacantes remotos causar una denegación de servicio (caída) y posiblemente ejecutar código arbitrario a través de un número grande de "stem hints" en un fichero de fuentes. • http://savannah.nongnu.org/bugs/?41697 http://secunia.com/advisories/57291 http://secunia.com/advisories/57447 http://sourceforge.net/projects/freetype/files/freetype2/2.5.3 http://www.freetype.org/index.html http://www.securityfocus.com/bid/66074 http://www.securitytracker.com/id/1029895 http://www.ubuntu.com/usn/USN-2148-1 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •