NetSight
IP …
high7.5

CVE-2014-9674

The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, whi…

Impact

The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.

Affected products

VendorProductAffected versions
CanonicalUbuntu Linux
Versions 10.04, 12.04, 14.04, 14.10, 15.04
OracleSolaris
Versions 10.0, 11.2
FedoraprojectFedora
Versions 20, 21
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Hpc Node
Versions 6.0, 7.0
RedhatEnterprise Linux Hpc Node Eus
Version 7.1
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Eus
Versions 6.6.z, 7.1
RedhatEnterprise Linux Workstation
Versions 6.0, 7.0
OpensuseOpensuse
Versions 13.1, 13.2
FreetypeFreetype
through 2.5.3

References