CVE-2016-10328
CriticalSummary
FreeType 2 before December 16, 2016, has an out-of-bounds write caused by a heap-based buffer overflow related to the cff_parser_run function in cff/cffparse.c.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized memory access, potentially resulting in arbitrary code execution or application crashes.
Recommendation
It is recommended to update FreeType to a version after December 16, 2016, to mitigate this vulnerability.
Other vulnerabilities in FreeType 2
See all- CVE-2014-9747High
The t42_parse_encoding function in FreeType before version 2.5.4 does not properly update the current position for immediates-only mode, allowing remote attackers to cause a denial of service (infinite loop) via a Type42 font.
- CVE-2014-9674High
The Mac_Read_POST_Resource function in FreeType before version 2.5.4 does not validate length values, which can lead to integer overflow and heap-based buffer overflow, allowing remote attackers to cause a denial of service.
- CVE-2014-9668High
The woff_open_font function in FreeType before version 2.5.4 performs offset and length calculations without restricting length values, which can lead to integer overflow and heap-based buffer overflow.
- CVE-2014-9665High
The Load_SBit_Png function in FreeType before version 2.5.4 does not restrict the rows and pitch values of PNG data, allowing remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) by embedding a PNG file in a .ttf font file.
- CVE-2014-9663High
The tt_cmap4_validate function in FreeType before version 2.5.4 validates a certain length field before that field's value is completely calculated, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table.
- CVE-2014-9662High
In FreeType versions before 2.5.4, return values of point-allocation functions are not validated, which can lead to a heap-based buffer overflow. Remote attackers may exploit this to cause a denial of service or possibly have unspecified other impact via a crafted OTF font.
- CVE-2014-9661High
In FreeType before version 2.5.4, the type42/t42parse.c file does not consider that scanning can be incomplete without triggering an error, allowing remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font.
- CVE-2014-9660High
The _bdf_parse_glyphs function in FreeType before version 2.5.4 does not properly handle a missing ENDCHAR record, which can lead to denial of service (NULL pointer dereference) or other unspecified impacts via a crafted BDF font.
- CVE-2014-9659High
The CFF CharString interpreter in FreeType before version 2.5.4 has a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted OpenType font.
- CVE-2014-9658High
The tt_face_load_kern function in FreeType before version 2.5.4 enforces an incorrect minimum table length, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.
Original NVD description (English source)
FreeType 2 before 2016-12-16 has an out-of-bounds write caused by a heap-based buffer overflow related to the cff_parser_run function in cff/cffparse.c.