CVSS: 6.8EPSS: 3%CPEs: 20EXPL: 1CVE-2014-9673 – freetype: integer signedness error in Mac_Read_POST_Resource() leading to heap-based buffer overflow
https://notcve.org/view.php?id=CVE-2014-9673
Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font. Error de signo de enteros en la función Mac_Read_POST_Resource en base/ftobjs.c en FreeType anterior a 2.5.4 permite a atacantes remotos causar una denegación de servicio (desbordamiento de buffer basado en memoria dinámica) o posiblemente tener otro impacto no especificado a través de una fuente Mac manipulada. An integer signedness flaw, leading to a heap-based buffer overflow, was found in the way FreeType handled Mac fonts. If a specially crafted font file was loaded by an application linked against FreeType, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. • http://advisories.mageia.org/MGASA-2015-0083.html http://code.google.com/p/google-security-research/issues/detail?id=154 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=35252ae9aa1dd9343e9f4884e9ddb1fee10ef415 http://lists.opensuse.org/opensuse-updates/2015-03/msg00091.html http://rhn.redhat.com/errata/RHSA-2015-0696.html http://www.debian.org/security/2015/dsa-3188 http://www.mandriva.com/security/advisories?name=MDVSA-2015:055 http://www.oracle.com/technetwork/topics/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 7.5EPSS: 2%CPEs: 23EXPL: 1CVE-2014-9674 – freetype: multiple integer overflows Mac_Read_POST_Resource() leading to heap-based buffer overflows
https://notcve.org/view.php?id=CVE-2014-9674
The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font. La función Mac_Read_POST_Resource en base/ftobjs.c en FreeType anterior a 2.5.4 proceda con la suma de los valores de longitud sin validar los valores originales, lo que permite a atacantes remotos causar una denegación de servicio (desbordamiento de enteros y desbordamiento de buffer basado en memoria dinámica) o posiblemente tener otro impacto no especificado a través de una fuente Mac manipulada. Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way FreeType handled Mac fonts. If a specially crafted font file was loaded by an application linked against FreeType, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. • http://advisories.mageia.org/MGASA-2015-0083.html http://code.google.com/p/google-security-research/issues/detail?id=153 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=240c94a185cd8dae7d03059abec8a5662c35ecd3 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=cd4a5a26e591d01494567df9dec7f72d59551f6e http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150148.html http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150162.html http://lists.opensuse& • CWE-122: Heap-based Buffer Overflow •
CVSS: 5.0EPSS: 0%CPEs: 22EXPL: 1CVE-2014-9675 – freetype: information leak in _bdf_add_property()
https://notcve.org/view.php?id=CVE-2014-9675
bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font. bdf/bdflib.c en FreeType anterior a 2.5.4 identifica los nombres de propiedades con solamente verificar que una subcadena inicial esté presente, lo que permite a atacantes remotos descubrir valores de punteros de la memoria dinámica y evadir el mecanismo de protección ASLR a través de una fuente BDF manipulada. • http://advisories.mageia.org/MGASA-2015-0083.html http://code.google.com/p/google-security-research/issues/detail?id=151 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=2c4832d30939b45c05757f0a05128ce64c4cacc7 http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150148.html http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150162.html http://lists.opensuse.org/opensuse-updates/2015-03/msg00091.html http://rhn.redhat.com/errata/RHSA-2015-0696.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 1%CPEs: 4EXPL: 1CVE-2014-2241
https://notcve.org/view.php?id=CVE-2014-2241
The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service (assertion failure), as demonstrated by a crafted ttf file. Las funciones (1) cf2_initLocalRegionBuffer y (2) cf2_initGlobalRegionBuffer en cff/cf2ft.c en FreeType anterior a 2.5.3 no comprueban debidamente si una subrutina existe, lo que permite a atacantes remotos causar una denegación de servicio (fallo de aserción), tal y como fue demostrado por un archivo ttf manipulado. • http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=135c3faebb96f8f550bd4f318716f2e1e095a969 http://savannah.nongnu.org/bugs/?41697 http://secunia.com/advisories/57447 http://www.openwall.com/lists/oss-security/2014/03/12/4 http://www.ubuntu.com/usn/USN-2148-1 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 13%CPEs: 52EXPL: 0CVE-2014-2240
https://notcve.org/view.php?id=CVE-2014-2240
Stack-based buffer overflow in the cf2_hintmap_build function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of stem hints in a font file. Desbordamiento de buffer basado en pila en la función cf2_hintmap_build en cff/cf2hints.c en FreeType anterior a 2.5.3 permite a atacantes remotos causar una denegación de servicio (caída) y posiblemente ejecutar código arbitrario a través de un número grande de "stem hints" en un fichero de fuentes. • http://savannah.nongnu.org/bugs/?41697 http://secunia.com/advisories/57291 http://secunia.com/advisories/57447 http://sourceforge.net/projects/freetype/files/freetype2/2.5.3 http://www.freetype.org/index.html http://www.securityfocus.com/bid/66074 http://www.securitytracker.com/id/1029895 http://www.ubuntu.com/usn/USN-2148-1 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •