Heap overflow

cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via a crafted OTF font...

Out-of-bounds

The ttfaceloadkern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service out-of-bounds read or possibly have unspecified other impact via a crafted TrueType font...

Integer overflow

The LoadSBitPng function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows remote attackers to cause a denial of service integer overflow and heap-based buffer overflow or possibly have unspecified other impact by embedding a PNG file...

Integer overflow

Integer signedness error in the MacReadPOSTResource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via a crafted Mac font...

CVE-2014-9665

The LoadSBitPng function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows remote attackers to cause a denial of service integer overflow and heap-based buffer overflow or possibly have unspecified other impact by embedding a PNG file...

CVE-2014-9664

FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service out-of-bounds read or possibly have unspecified other impact via a crafted Type42 font, related to type42/t42parse.c and type1/t1load.c...

CVE-2014-9668

The woffopenfont function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting length values, which allows remote attackers to cause a denial of service integer overflow and heap-based buffer overflow or possibly have unspecified other impact via ...

CVE-2014-9674

The MacReadPOSTResource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service integer overflow and heap-based buffer overflow or possibly have unspecified other...

CVE-2014-9660

The bdfparseglyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service NULL pointer dereference or possibly have unspecified other impact via a crafted BDF font...

CVE-2014-9665

CVE-2014-9665 affects FreeType before 2.5.4, where Load_SBit_Png in sfnt/pngshim.c does not constrain rows/pitch when parsing PNG data embedded in a TTF font. This can trigger an integer overflow and heap-based buffer overflow, leading to denial of service (and possibly other impact) per the CVE ...

CVE-2014-9672

Array index error in the parsefond function in base/ftmac.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service out-of-bounds read or obtain sensitive information from process memory via a crafted FOND resource in a Mac font file...

CVE-2014-9673

Integer signedness error in the MacReadPOSTResource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via a crafted Mac font...

CVE-2014-9657

The ttfaceloadhdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service out-of-bounds read or possibly have unspecified other impact via a crafted TrueType font...

CVE-2014-9665

The LoadSBitPng function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows remote attackers to cause a denial of service integer overflow and heap-based buffer overflow or possibly have unspecified other impact by embedding a PNG file...

CVE-2014-9661

CVE-2014-9661 in FreeType 2.x prior to 2.5.4 affects type42/t42parse.c, where parsing can be incomplete without triggering an error. This leads to a denial of service via a crafted Type42/OpenType font and may cause a use-after-free or other unspecified impact. The vulnerability is triggered when...

CVE-2014-9668

CVE-2014-9668 relates to FreeType. The issue stems from the woff_open_font function (sfnt/sfobjs.c) where offset+length is calculated without restricting length values, enabling a remote attacker to trigger a denial of service via a crafted WOFF file (integer overflow and heap-based buffer overfl...

CVE-2014-9672

CVE-2014-9672 affects FreeType before 2.5.4, where an array index error in parse_fond (base/ftmac.c) can be triggered by a crafted FOND resource in a Mac font file, enabling a denial of service (out-of-bounds read) and potential information disclosure from process memory. The connected documents ...

CVE-2014-9657

CVE-2014-9657 affects FreeType before 2.5.4, where tt_face_load_hdmx does not enforce a minimum record size, enabling a remote attacker to trigger a denial of service (out-of-bounds read) or other impact via a crafted TrueType font. Connected sources corroborate multiple FreeType flaws and link r...

CVE-2014-9657

The ttfaceloadhdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service out-of-bounds read or possibly have unspecified other impact via a crafted TrueType font...

CVE-2014-9658

The ttfaceloadkern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service out-of-bounds read or possibly have unspecified other impact via a crafted TrueType font...