NetSight
IP …
high7.5

CVE-2014-9656

The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType before 2.5.4 does not properly check for an integer overflow, which allows remote attacker…

Impact

The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType before 2.5.4 does not properly check for an integer overflow, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted OpenType font.

Affected products

VendorProductAffected versions
FedoraprojectFedora
Versions 20, 21
FreetypeFreetype
through 2.5.3
DebianDebian Linux
Version 7.0
OpensuseOpensuse
Versions 13.1, 13.2
CanonicalUbuntu Linux
Versions 10.04, 12.04, 14.04, 14.10, 15.04

Weakness classification

CWE-119

References