CVE-2014-9746
CriticalSummary
In FreeType versions before 2.5.4, functions responsible for parsing font matrices do not check return values, which can lead to uninitialized memory access and application crashes.
Risk Assessment
Remote attackers can exploit this vulnerability to cause a denial of service, potentially affecting the availability of applications using FreeType.
Recommendation
It is recommended to update FreeType to version 2.5.4 or later to mitigate this vulnerability.
Original NVD description (English source)
The (1) t1_parse_font_matrix function in type1/t1load.c, (2) cid_parse_font_matrix function in cid/cidload.c, (3) t42_parse_font_matrix function in type42/t42parse.c, and (4) ps_parser_load_field function in psaux/psobjs.c in FreeType before 2.5.4 do not check return values, which allows remote attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted font.