FreeType vulnerabilities

The t42_parse_encoding function in FreeType before version 2.5.4 does not properly update the current position for immediates-only mode, allowing remote attackers to cause a denial of service (infinite loop) via a Type42 font.

The Mac_Read_POST_Resource function in FreeType before version 2.5.4 does not validate length values, which can lead to integer overflow and heap-based buffer overflow, allowing remote attackers to cause a denial of service.

The woff_open_font function in FreeType before version 2.5.4 performs offset and length calculations without restricting length values, which can lead to integer overflow and heap-based buffer overflow.

The Load_SBit_Png function in FreeType before version 2.5.4 does not restrict the rows and pitch values of PNG data, allowing remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) by embedding a PNG file in a .ttf font file.

The tt_cmap4_validate function in FreeType before version 2.5.4 validates a certain length field before that field's value is completely calculated, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table.

In FreeType versions before 2.5.4, return values of point-allocation functions are not validated, which can lead to a heap-based buffer overflow. Remote attackers may exploit this to cause a denial of service or possibly have unspecified other impact via a crafted OTF font.

In FreeType before version 2.5.4, the type42/t42parse.c file does not consider that scanning can be incomplete without triggering an error, allowing remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font.

The _bdf_parse_glyphs function in FreeType before version 2.5.4 does not properly handle a missing ENDCHAR record, which can lead to denial of service (NULL pointer dereference) or other unspecified impacts via a crafted BDF font.

The CFF CharString interpreter in FreeType before version 2.5.4 has a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted OpenType font.

The tt_face_load_kern function in FreeType before version 2.5.4 enforces an incorrect minimum table length, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.

The tt_face_load_hdmx function in FreeType before 2.5.4 does not establish a minimum record size, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.

The tt_sbit_decoder_load_image function in FreeType before 2.5.4 does not properly check for an integer overflow, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted OpenType font.

A stack-based buffer overflow in the cf2_hintmap_build function in FreeType before version 2.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of stem hints in a font file.

FreeType 2 before March 26, 2017, has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c.

FreeType 2 before March 24, 2017, has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c.

FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tt_size_reset function in truetype/ttobjs.c.

FreeType 2 before 2017-03-07 has an out-of-bounds write related to the TT_Get_MM_Var function in truetype/ttgxvar.c and the sfnt_init_face function in sfnt/sfobjs.c.

FreeType 2 before 2017-03-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the TT_Get_MM_Var function and the sfnt_init_face function.

FreeType 2 before December 16, 2016, has an out-of-bounds write caused by a heap-based buffer overflow related to the cff_parser_run function in cff/cffparse.c.

In FreeType versions before 2.5.4, functions responsible for parsing font matrices do not check return values, which can lead to uninitialized memory access and application crashes.

An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates.

A segmentation violation was discovered in the FreeType library in the FT_Request_Size function, potentially causing program crashes.

A segmentation violation was discovered in the FreeType library in the FNT_Size_Request function, potentially causing program crashes.