Arbitrary Code Execution

2020-04-1000:49:48

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

JSON

freetype is vulnerable to arbitrary code execution. The vulnerability exists as an integer overflow flaw was found in the way the FreeType font engine processed font files. If a user loaded a carefully-crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application.

CPENameOperatorVersion
freetypeeq2.2.1__16.el5
freetypeeq2.1.9__1.rhel4.4
freetypeeq2.1.9__6.el4
freetypeeq2.2.1__17.el5
freetypeeq2.2.1__21.el5_3
freetypeeq2.1.4__5.el3
freetypeeq2.1.4__4.0.rhel3.2
freetypeeq2.1.9__4.el4
freetypeeq2.1.4__8.el3
freetypeeq2.1.9__8.el4.6

Name	Operator	Version
freetype	eq	2.2.1__16.el5
freetype	eq	2.1.9__1.rhel4.4
freetype	eq	2.1.9__6.el4
freetype	eq	2.2.1__17.el5
freetype	eq	2.2.1__21.el5_3
freetype	eq	2.1.4__5.el3
freetype	eq	2.1.4__4.0.rhel3.2
freetype	eq	2.1.9__4.el4
freetype	eq	2.1.4__8.el3
freetype	eq	2.1.9__8.el4.6