CVE-2014-9665

The Load_SBit_Png function in sfnt/pngshim.c in FreeType before 2.5.4 does
not restrict the rows and pitch values of PNG data, which allows remote
attackers to cause a denial of service (integer overflow and heap-based
buffer overflow) or possibly have unspecified other impact by embedding a
PNG file in a .ttf font file.

Bugs

• <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777656&gt;
• <http://code.google.com/p/google-security-research/issues/detail?id=168&gt;
• <http://savannah.nongnu.org/bugs/?43597&gt;