CVE-2022-27406
HighCVSS 7.5Exploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
A segmentation violation was discovered in the FreeType library in the FT_Request_Size function, potentially causing program crashes.
Risk Assessment
An attacker could exploit this vulnerability to cause a denial of service (DoS) by processing a specially crafted font file.
Recommendation
Update the FreeType library to the latest version that includes the fix for commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5.
Other vulnerabilities in FreeType
See all- CVE-2014-9747High
The t42_parse_encoding function in FreeType before version 2.5.4 does not properly update the current position for immediates-only mode, allowing remote attackers to cause a denial of service (infinite loop) via a Type42 font.
- CVE-2014-9674High
The Mac_Read_POST_Resource function in FreeType before version 2.5.4 does not validate length values, which can lead to integer overflow and heap-based buffer overflow, allowing remote attackers to cause a denial of service.
- CVE-2014-9668High
The woff_open_font function in FreeType before version 2.5.4 performs offset and length calculations without restricting length values, which can lead to integer overflow and heap-based buffer overflow.
- CVE-2014-9665High
The Load_SBit_Png function in FreeType before version 2.5.4 does not restrict the rows and pitch values of PNG data, allowing remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) by embedding a PNG file in a .ttf font file.
- CVE-2014-9663High
The tt_cmap4_validate function in FreeType before version 2.5.4 validates a certain length field before that field's value is completely calculated, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table.
- CVE-2014-9662High
In FreeType versions before 2.5.4, return values of point-allocation functions are not validated, which can lead to a heap-based buffer overflow. Remote attackers may exploit this to cause a denial of service or possibly have unspecified other impact via a crafted OTF font.
- CVE-2014-9661High
In FreeType before version 2.5.4, the type42/t42parse.c file does not consider that scanning can be incomplete without triggering an error, allowing remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font.
- CVE-2014-9660High
The _bdf_parse_glyphs function in FreeType before version 2.5.4 does not properly handle a missing ENDCHAR record, which can lead to denial of service (NULL pointer dereference) or other unspecified impacts via a crafted BDF font.
- CVE-2014-9659High
The CFF CharString interpreter in FreeType before version 2.5.4 has a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted OpenType font.
- CVE-2014-9658High
The tt_face_load_kern function in FreeType before version 2.5.4 enforces an incorrect minimum table length, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.
Original NVD description (English source)
FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size.