Integer overflow

sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service integer overflow and out-of-bounds read or possibly have unspecified other impact via a crafted SFNT table...

CVE-2014-9667

CVE-2014-9667 affects FreeType up to version 2.5.3, where sfnt/ttload.c performs offset+length calculations without restricting values, enabling a remote attacker to cause a denial of service via an integer overflow and out-of-bounds read when processing a crafted SFNT table. The vulnerability is...

CVE-2014-9667

sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service integer overflow and out-of-bounds read or possibly have unspecified other impact via a crafted SFNT table...