libXfont2 -- multiple vulnerabilities

Zhixi "Jace" Sun, independent security researcher reports: CVE-2026-44950: Font Server Client Cumulative Glyph Data Heap Buffer Overflow CVE-2026-59679: Font Server Client encoding Out-Of-Bounds Read/Write...

CLSA-2026-1771010890 freerdp: Fix of 5 CVEs

CVE-2026-22859: fix out-of-bounds access due to missing interface index validation in urbdrc channel - CVE-2026-23732: fix out-of-bounds read due to missing input length check in glyph conversion - CVE-2026-23883: fix integer overflow in cursor pixel allocation and surface-to-surface rectangle...

CVE-2026-23531

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when glyphData is present, cleardecompress calls freerdpimagecopynooverlap without validating the destination rectangle, allowing an out-of-bounds read/write via crafted RDPGFX surface updates...

CVE-2026-23531 FreeRDP has heap-buffer-overflow in clear_decompress

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when glyphData is present, cleardecompress calls freerdpimagecopynooverlap without validating the destination rectangle, allowing an out-of-bounds read/write via crafted RDPGFX surface updates...

SUSE CVE-2012-1139

Array index error in FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service invalid stack read operation and memory corruption or possibly execute arbitrary code via crafted glyph data in a BDF font...

ghostscript:gs_device_pdfwrite_fuzzer: Crash in names_index_ref

Detailed Report: https://oss-fuzz.com/testcase?key=4880033168097280 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gsdevicepdfwritefuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x62f004020468 Crash State: namesindexref...

PT-2022-37196

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow read crash has been reported. The crash involves the functions copy glyph data, copy glyph type1, and gs copy glyph options. No...

PT-2022-37199

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack-buffer-overflow crash. Technical details about the crash include the functions gs glyph data from bytes, pdfi cff subr data...

PT-2022-37188

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack-buffer-overflow crash. Technical details about the crash include the functions gs glyph data from string, copied type1 subr...

ghostscript:gs_device_pdfwrite_fuzzer: Stack-buffer-overflow in gs_glyph_data_from_string

Detailed Report: https://oss-fuzz.com/testcase?key=6152113700339712 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gsdevicepdfwritefuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 8 Crash Address: 0x7ffcf5252b40 Crash State:...

PT-2022-36868

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN READ. The crash state involves functions such as pdfi fapi get glyph, get fapi glyph data, and cff slot loa...

PT-2021-27948

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type identified as a global buffer overflow read. The crash state involves functions such as pdfi fapi get glyph, get fapi...

PT-2020-22017

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash caused by the use of an uninitialized value. The crash occurs in the following functions: get fapi glyph data, load truetyp...

CVE-2012-1139

Array index error in FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service invalid stack read operation and memory corruption or possibly execute arbitrary code via crafted glyph data in a BDF font...

CVE-2012-1139

Array index error in FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service invalid stack read operation and memory corruption or possibly execute arbitrary code via crafted glyph data in a BDF font...

DEBIAN-CVE-2012-1139

Array index error in FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service invalid stack read operation and memory corruption or possibly execute arbitrary code via crafted glyph data in a BDF font...

Memory corruption

Array index error in FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service invalid stack read operation and memory corruption or possibly execute arbitrary code via crafted glyph data in a BDF font...

CVE-2012-1139

Array index error in FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service invalid stack read operation and memory corruption or possibly execute arbitrary code via crafted glyph data in a BDF font...

CVE-2012-1139

Array index error in FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service invalid stack read operation and memory corruption or possibly execute arbitrary code via crafted glyph data in a BDF font...

freetype: data buffer underflow in BDF parser _bdf_parse_glyphs() (#35656)

Array index error in FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service invalid stack read operation and memory corruption or possibly execute arbitrary code via crafted glyph data in a BDF font...