CVE-2014-9667

sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length
calculations without restricting the values, which allows remote attackers
to cause a denial of service (integer overflow and out-of-bounds read) or
possibly have unspecified other impact via a crafted SFNT table.

Bugs

• <http://code.google.com/p/google-security-research/issues/detail?id=166&gt;
• <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777656&gt;
• <http://savannah.nongnu.org/bugs/?43590&gt;