NetSight
IP …
medium6.8

CVE-2014-9666

The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, whic…

Impact

The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted embedded bitmap.

Affected products

VendorProductAffected versions
OpensuseOpensuse
Versions 13.1, 13.2
OracleSolaris
Versions 10.0, 11.2
CanonicalUbuntu Linux
Versions 10.04, 12.04, 14.04, 14.10, 15.04
DebianDebian Linux
Version 7.0
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Hpc Node
Versions 6, 7.0
RedhatEnterprise Linux Hpc Node Eus
Version 7.1
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Eus
Versions 6.6.z, 7.1
RedhatEnterprise Linux Workstation
Versions 6.0, 7.0
FedoraprojectFedora
Versions 20, 21
FreetypeFreetype
through 2.5.3

Weakness classification

CWE-189

References