CVE-2014-9661

type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font.

References

Affected packages

Debian:11 / freetype

Package

Name: freetype
Purl: pkg:deb/debian/freetype?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.5.2-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / freetype

Package

Name: freetype
Purl: pkg:deb/debian/freetype?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.5.2-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / freetype

Package

Name: freetype
Purl: pkg:deb/debian/freetype?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.5.2-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}