CVE-2009-0946

2009-04-1700:00:00

ubuntu.com

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.036 Low

EPSS

Percentile

91.6%

JSON

Multiple integer overflows in FreeType 2.3.9 and earlier allow remote
attackers to execute arbitrary code via vectors related to large values in
certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3)
cff/cffload.c.

Notes

Author	Note
mdeslaur	reproducers don’t crash freetype1

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchfreetype< 2.1.10-1ubuntu2.6UNKNOWN
ubuntu8.04noarchfreetype< 2.3.5-1ubuntu4.8.04.2UNKNOWN
ubuntu8.10noarchfreetype< 2.3.7-2ubuntu1.1UNKNOWN
ubuntu9.04noarchfreetype< 2.3.9-4ubuntu0.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	6.06	noarch	freetype	< 2.1.10-1ubuntu2.6	UNKNOWN
ubuntu	8.04	noarch	freetype	< 2.3.5-1ubuntu4.8.04.2	UNKNOWN
ubuntu	8.10	noarch	freetype	< 2.3.7-2ubuntu1.1	UNKNOWN
ubuntu	9.04	noarch	freetype	< 2.3.9-4ubuntu0.1	UNKNOWN