CVE-2014-9659
Description
cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint mask has been computed, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted OpenType font. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2240.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
OS impact
Fedora Affected 2 releases
| Version | Status | Fixed in |
|---|---|---|
| 21 | Affected | — |
| 20 | Affected | — |
SUSE Affected 2 releases
| Version | Status | Fixed in |
|---|---|---|
| 13.2 | Affected | — |
| 13.1 | Affected | — |
Ubuntu Affected 5 releases
| Version | Status | Fixed in |
|---|---|---|
| 15.04 | Affected | — |
| 14.10 | Affected | — |
| 14.04 | Affected | — |
| 12.04 | Affected | — |
| 10.04 | Affected | — |
Debian Fixed 5 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 2.5.2-3 |
| sid | Fixed | 2.5.2-3 |
| forky | Fixed | 2.5.2-3 |
| bullseye | Fixed | 2.5.2-3 |
| bookworm | Fixed | 2.5.2-3 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| freetype | freetype | {"endIncluding":"2.5.3"} | |
References
- http://code.google.com/p/google-security-research/issues/detail?id=190
- http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=2cdc4562f873237f1c77d43540537c7a721d3fd8
- http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150148.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150162.html
- http://lists.opensuse.org/opensuse-updates/2015-03/msg00091.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.ubuntu.com/usn/USN-2510-1
- http://www.ubuntu.com/usn/USN-2739-1
- https://security.gentoo.org/glsa/201503-05
- https://security-tracker.debian.org/tracker/CVE-2014-9659
CWEs
CWE-119
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.