Out-of-Bounds The advisory has been revoked - it doesn't affect any version of package freetype (opens in a new tab)

Threat Intelligence

4.89% (91^st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-UBUNTU1204-FREETYPE-628712
published8 Feb 2015
disclosed8 Feb 2015

Report a new vulnerability Found a mistake?

Introduced: 8 Feb 2015

CVE-2014-9665 (opens in a new tab) CWE-119 (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:12.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream freetype package and not the freetype package as distributed by Ubuntu.

The Load_SBit_Png function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact by embedding a PNG file in a .ttf font file.