CVE-2025-40322 fbdev: bitblit: bound-check glyph index in bit_putcs*

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitputcs bitputcsaligned/unaligned derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the...

CVE-2025-40322

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitputcs bitputcsaligned/unaligned derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the...

CVE-2025-40322

The CVE-2025-40322 issue affects the Linux kernel fbdev font handling. The bound-check for glyph indices in bit_putcs_aligned() and bit_putcs_unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which could exceed the font’s glyph count and cause an out-of-bounds r...

freetype: incorrect computation of number of glyphs in FNT_Face_Init() for FNT/FON files (#35659)

FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service invalid heap write operation and memory corruption or possibly execute arbitrary code via crafted glyph-outline data in a font...