FreeType: Heap-based buffer overflow by processing FontType42 fonts with negative length of SFNT strings (FT bug #30656)

Array index error in the t42parsesfnts function in type42/t42parse.c in FreeType before 2.4.2 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via negative size values for certain strings in FontType42 font files, leading to a heap-based...

CVE-2009-0946

Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in 1 smooth/ftsmooth.c, 2 sfnt/ttcmap.c, and 3 cff/cffload.c...

freetype: multiple integer overflow vulnerabilities

Multiple integer overflows in FreeType before 2.2 allow remote attackers to cause a denial of service crash and possibly execute arbitrary code via attack vectors related to 1 bdf/bdflib.c, 2 sfnt/ttcmap.c, 3 cff/cffgload.c, and 4 the readlwfn function and a crafted LWFN file in base/ftmac.c. NOT...