Multiple vulnerabilities have been found in FreeType, one of which includes information leak.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/freetype | * | < 2.14.3 | >= 2.14.3 |
FreeType is a software font engine that is designed to be small, efficient, highly customizable, and portable while capable of producing high-quality output (glyph images).
Multiple vulnerabilities have been discovered in FreeType. Please review the CVE identifiers referenced below for details.
One of the possible outcomes allows for an out-of-bounds read. Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All FreeType users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/freetype-2.14.3"
A vulnerability has been discovered in FreeType, which can lead to remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/freetype | * | < 2.13.1 | >= 2.13.1 |
FreeType is a high-quality and portable font engine.
Multiple vulnerabilities have been discovered in FreeType. Please review the CVE identifiers referenced below for details.
An out of bounds write exists in FreeType when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.
There is no known workaround at this time.
All FreeType users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/freetype-2.13.1"
Multiple vulnerabilities have been discovered in FreeType, the worst of which can lead to remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/freetype | * | < 2.13.0 | >= 2.13.0 |
FreeType is a high-quality and portable font engine.
Multiple vulnerabilities have been discovered in FreeType. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All FreeType users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/freetype-2.13.0"
A buffer overflow in FreeType might allow remote attacker(s) to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/freetype | * | < 2.10.3-r1 | >= 2.10.3-r1 |
FreeType is a high-quality and portable font engine.
A flaw in FreeType’s handling of embedded PNG bitmaps was discovered where the image height and width was not checked to be within bounds.
A remote attacker could entice a user to open a specially crafted font file using FreeType possibly resulting in the execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All FreeType users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/freetype-2.10.3-r1"
Multiple vulnerabilities have been found in FreeType, the worst of which allows remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/freetype | * | < 2.8 | >= 2.8 |
FreeType is a high-quality and portable font engine.
Multiple vulnerabilities have been discovered in FreeType. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user to use a specially crafted font file using FreeType, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All FreeType users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/freetype-2.8"
Multiple vulnerabilities have been found in FreeType, possibly resulting in Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/freetype | * | < 2.5.5 | >= 2.5.5 |
FreeType is a high-quality and portable font engine.
Multiple vulnerabilities have been discovered in FreeType. Please review the CVE identifiers referenced below for details.
A remote attacker can cause Denial of Service.
There is no known workaround at this time.
All FreeType users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/freetype-2.5.5"
A vulnerability in FreeType could result in execution of arbitrary code or Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/freetype | * | < 2.5.3-r1 | >= 2.5.3-r1 |
FreeType is a high-quality and portable font engine.
A stack-based buffer overflow exists in Freetype’s cf2_hintmap_build function in cff/cf2hints.c.
A remote attacker may be able to execute arbitrary code or cause a Denial of Service condition via specially crafted font file.
There is no known workaround at this time.
All FreeType users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/freetype-2.5.3-r1"
Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying these packages.
Multiple vulnerabilities have been found in FreeType, allowing context-dependent attackers to possibly execute arbitrary code or cause Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/freetype | * | < 2.4.11 | >= 2.4.11 |
FreeType is a high-quality and portable font engine.
Multiple vulnerabilities have been discovered in FreeType. Please review the CVE identifiers referenced below for details.
A context-dependent attacker could entice a user to open a specially crafted font, possibly resulting in execution of arbitrary code with the privileges of the user running the application, or a Denial of Service condition.
There is no known workaround at this time.
All Freetype users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/freetype-2.4.11"
Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying these packages.
Multiple vulnerabilities have been found in FreeType, allowing remote attackers to possibly execute arbitrary code or cause Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/freetype | * | < 2.4.9 | >= 2.4.9 |
FreeType is a high-quality and portable font engine.
Multiple vulnerabilities have been discovered in FreeType. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user to open a specially crafted font, possibly resulting in execution of arbitrary code with the privileges of the user running the application, or a Denial of Service condition.
There is no known workaround at this time.
All FreeType users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/freetype-2.4.9"
Multiple vulnerabilities have been found in FreeType, allowing remote attackers to possibly execute arbitrary code or cause a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/freetype | * | < 2.4.8 | >= 2.4.8 |
FreeType is a high-quality and portable font engine.
Multiple vulnerabilities have been discovered in FreeType. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user to open a specially crafted font, possibly resulting in the remote execution of arbitrary code with the privileges of the user running the application, or a Denial of Service.
There is no known workaround at this time.
All FreeType users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/freetype-2.4.8"
Multiple vulnerabilities in FreeType might result in the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/freetype | * | < 1.4_pre20080316-r2 | >= 1.4_pre20080316-r2 |
FreeType is a True Type Font rendering library.
Multiple issues found in FreeType 2 were also discovered in FreeType 1. For details on these issues, please review the Gentoo Linux Security Advisories and CVE identifiers referenced below.
A remote attacker could entice a user to open a specially crafted TTF file, possibly resulting in the execution of arbitrary code with the privileges of the user running FreeType.
There is no known workaround at this time.
All FreeType 1 users should upgrade to an unaffected version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/freetype-1.4_pre20080316-r2"
NOTE: This is a legacy GLSA. Updates for all affected architectures are available since May 27, 2009. It is likely that your system is already no longer affected by this issue.
Multiple integer overflows in FreeType might allow for the remote execution of arbitrary code or a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/freetype | * | < 2.3.9-r1 | >= 2.3.9-r1, < 2.0 |
FreeType is a high-quality and portable font engine.
Tavis Ormandy reported multiple integer overflows in the cff_charset_compute_cids() function in cff/cffload.c, sfnt/tccmap.c and the ft_smooth_render_generic() function in smooth/ftsmooth.c, possibly leading to heap or stack-based buffer overflows.
A remote attacker could entice a user or automated system to open a specially crafted font file, possibly resulting in the execution of arbitrary code with the privileges of the user running the application, or a Denial of Service.
There is no known workaround at this time.
All FreeType users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/freetype-2.3.9-r1"
Font parsing vulnerabilities in FreeType might lead to user-assisted execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/freetype | * | < 2.3.6 | >= 2.3.6, >= 1.4_pre20080316-r1 (revision) |
FreeType is a font rendering library for TrueType Font (TTF) and Printer Font Binary (PFB).
Regenrecht reported multiple vulnerabilities in FreeType via iDefense:
A remote attacker could entice a user to open a specially crafted TTF or PBF file, possibly resulting in the execution of arbitrary code with the privileges of the user running an application linked against FreeType (such as the X.org X server, running as root).
There is no known workaround at this time.
All FreeType users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/freetype-2.3.6"
A vulnerability has been discovered in FreeType allowing for the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/freetype | * | < 2.3.4-r2 | >= 2.3.4-r2, < 2.0 |
FreeType is a True Type Font rendering library.
Victor Stinner discovered a heap-based buffer overflow in the function Get_VMetrics() in src/truetype/ttgload.c when processing TTF files with a negative n_points attribute.
A remote attacker could entice a user to open a specially crafted TTF file, possibly resulting in the execution of arbitrary code with the privileges of the user running FreeType.
There is no known workaround at this time.
All FreeType users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/freetype-2.3.4-r2"
A vulnerability has been discovered in FreeType allowing for user-assisted remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/freetype | * | < 2.1.10-r3 | >= 2.1.10-r3, < 2.0 |
FreeType is a True Type Font rendering library.
Greg MacManus of iDefense Labs has discovered an integer overflow in the function bdfReadCharacters() when parsing BDF fonts.
A remote attacker could entice a user to use a specially crafted BDF font, possibly resulting in a heap-based buffer overflow and the remote execution of arbitrary code.
There is no known workaround at this time.
All FreeType users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/freetype-2.1.10-r3"
Multiple remotely exploitable buffer overflows have been discovered in FreeType, resulting in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/freetype | * | < 2.1.10-r2 | >= 2.1.10-r2, < 2.0 |
FreeType is a portable font engine.
Multiple integer overflows exist in a variety of files (bdf/bdflib.c, sfnt/ttcmap.c, cff/cffgload.c, base/ftmac.c).
A remote attacker could exploit these buffer overflows by enticing a user to load a specially crafted font, which could result in the execution of arbitrary code.
There is no known workaround at this time.
All FreeType users should upgrade to the latest stable version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/freetype-2.1.10-r2"