NetSight
IP …
high7.5

CVE-2014-9659

cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint mask has been computed, which allows re…

Impact

cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint mask has been computed, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted OpenType font. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2240.

Affected products

VendorProductAffected versions
OracleSolaris
Versions 10.0, 11.2
FreetypeFreetype
through 2.5.3
FedoraprojectFedora
Versions 20, 21
OpensuseOpensuse
Versions 13.1, 13.2
CanonicalUbuntu Linux
Versions 10.04, 12.04, 14.04, 14.10, 15.04

Weakness classification

CWE-119

References