NetSight
IP …
medium6.8

CVE-2014-2241

The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine ex…

Impact

The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service (assertion failure), as demonstrated by a crafted ttf file.

Affected products

VendorProductAffected versions
FreetypeFreetype
through 2.5.2
Versions 2.5, 2.5.1
CanonicalUbuntu Linux
Version 13.10

Weakness classification

CWE-20

References