NetSight
IP …
high7.5

CVE-2014-9662

cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows remote attackers to cause a denial of serv…

Impact

cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted OTF font.

Affected products

VendorProductAffected versions
OpensuseOpensuse
Versions 13.1, 13.2
DebianDebian Linux
Version 7.0
CanonicalUbuntu Linux
Versions 10.04, 12.04, 14.04, 14.10, 15.04
FedoraprojectFedora
Versions 20, 21
FreetypeFreetype
through 2.5.3

Weakness classification

CWE-119

References