CVE-2014-9747

The Mac_Read_POST_Resource function in FreeType before version 2.5.4 does not validate length values, which can lead to integer overflow and heap-based buffer overflow, allowing remote attackers to cause a denial of service.

The woff_open_font function in FreeType before version 2.5.4 performs offset and length calculations without restricting length values, which can lead to integer overflow and heap-based buffer overflow.

The Load_SBit_Png function in FreeType before version 2.5.4 does not restrict the rows and pitch values of PNG data, allowing remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) by embedding a PNG file in a .ttf font file.

The tt_cmap4_validate function in FreeType before version 2.5.4 validates a certain length field before that field's value is completely calculated, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table.

In FreeType versions before 2.5.4, return values of point-allocation functions are not validated, which can lead to a heap-based buffer overflow. Remote attackers may exploit this to cause a denial of service or possibly have unspecified other impact via a crafted OTF font.

In FreeType before version 2.5.4, the type42/t42parse.c file does not consider that scanning can be incomplete without triggering an error, allowing remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font.

The _bdf_parse_glyphs function in FreeType before version 2.5.4 does not properly handle a missing ENDCHAR record, which can lead to denial of service (NULL pointer dereference) or other unspecified impacts via a crafted BDF font.

The CFF CharString interpreter in FreeType before version 2.5.4 has a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted OpenType font.

The tt_face_load_kern function in FreeType before version 2.5.4 enforces an incorrect minimum table length, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.

The tt_face_load_hdmx function in FreeType before 2.5.4 does not establish a minimum record size, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.