Arbitrary Code Execution

2020-04-1000:48:58

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

JSON

freetype is vulnerable to arbitrary code execution. The vulnerability exists as it was discovered that the FreeType font rendering engine improperly validated certain position values when processing input streams. If a user loaded a specially-crafted font file with an application linked against FreeType, and the relevant font glyphs were subsequently rendered with the X FreeType library (libXft), it could trigger a heap-based buffer overflow in the libXft library, causing the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application.

CPENameOperatorVersion
freetypeeq2.1.9__4.el4
freetypeeq2.1.4__5.el3
freetypeeq2.1.4__7.el3
freetypeeq2.1.4__4.0.rhel3.2
freetypeeq2.1.9__5.el4
freetypeeq2.2.1__16.el5
freetypeeq2.1.4__6.el3
freetypeeq2.2.1__17.el5
freetypeeq2.1.9__7.el4.6
freetypeeq2.3.11__5.el6

Name	Operator	Version
freetype	eq	2.1.9__4.el4
freetype	eq	2.1.4__5.el3
freetype	eq	2.1.4__7.el3
freetype	eq	2.1.4__4.0.rhel3.2
freetype	eq	2.1.9__5.el4
freetype	eq	2.2.1__16.el5
freetype	eq	2.1.4__6.el3
freetype	eq	2.2.1__17.el5
freetype	eq	2.1.9__7.el4.6
freetype	eq	2.3.11__5.el6