Lucene search
MitreCVE-2014-2240HistoryMar 12, 2014 - 2:55 p.m.
CVE-2014-2240
2014-03-1214:55:30
CWE-119
mitre
web.nvd.nist.gov
40
cve-2014-2240
buffer overflow
freetype
remote attack
denial of service
arbitrary code execution
font file
nvd
CVSS2
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
AI Score
7.8
Confidence
Low
EPSS
0.139
Percentile
95.7%
Stack-based buffer overflow in the cf2_hintmap_build function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of stem hints in a font file.
Affected configurations
Node
freetypefreetypeRangeβ€2.5.2
ORfreetypefreetypeMatch1.3.1
ORfreetypefreetypeMatch2.0.0
ORfreetypefreetypeMatch2.0.1
ORfreetypefreetypeMatch2.0.2
ORfreetypefreetypeMatch2.0.3
ORfreetypefreetypeMatch2.0.4
ORfreetypefreetypeMatch2.0.5
ORfreetypefreetypeMatch2.0.6
ORfreetypefreetypeMatch2.0.7
ORfreetypefreetypeMatch2.0.8
ORfreetypefreetypeMatch2.0.9
ORfreetypefreetypeMatch2.1
ORfreetypefreetypeMatch2.1.3
ORfreetypefreetypeMatch2.1.4
ORfreetypefreetypeMatch2.1.5
ORfreetypefreetypeMatch2.1.6
ORfreetypefreetypeMatch2.1.7
ORfreetypefreetypeMatch2.1.8
ORfreetypefreetypeMatch2.1.8rc1
ORfreetypefreetypeMatch2.1.9
ORfreetypefreetypeMatch2.1.10
ORfreetypefreetypeMatch2.2.0
ORfreetypefreetypeMatch2.2.1
ORfreetypefreetypeMatch2.3.0
ORfreetypefreetypeMatch2.3.1
ORfreetypefreetypeMatch2.3.2
ORfreetypefreetypeMatch2.3.3
ORfreetypefreetypeMatch2.3.4
ORfreetypefreetypeMatch2.3.5
ORfreetypefreetypeMatch2.3.6
ORfreetypefreetypeMatch2.3.7
ORfreetypefreetypeMatch2.3.8
ORfreetypefreetypeMatch2.3.9
ORfreetypefreetypeMatch2.3.10
ORfreetypefreetypeMatch2.3.11
ORfreetypefreetypeMatch2.3.12
ORfreetypefreetypeMatch2.4.0
ORfreetypefreetypeMatch2.4.1
ORfreetypefreetypeMatch2.4.2
ORfreetypefreetypeMatch2.4.3
ORfreetypefreetypeMatch2.4.4
ORfreetypefreetypeMatch2.4.5
ORfreetypefreetypeMatch2.4.6
ORfreetypefreetypeMatch2.4.7
ORfreetypefreetypeMatch2.4.8
ORfreetypefreetypeMatch2.4.9
ORfreetypefreetypeMatch2.4.10
ORfreetypefreetypeMatch2.4.11
ORfreetypefreetypeMatch2.4.12
ORfreetypefreetypeMatch2.5
ORfreetypefreetypeMatch2.5.1
| Vendor | Product | Version | CPE |
|---|---|---|---|
| freetype | freetype | * | cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:* |
| freetype | freetype | 1.3.1 | cpe:2.3:a:freetype:freetype:1.3.1:*:*:*:*:*:*:* |
| freetype | freetype | 2.0.0 | cpe:2.3:a:freetype:freetype:2.0.0:*:*:*:*:*:*:* |
| freetype | freetype | 2.0.1 | cpe:2.3:a:freetype:freetype:2.0.1:*:*:*:*:*:*:* |
| freetype | freetype | 2.0.2 | cpe:2.3:a:freetype:freetype:2.0.2:*:*:*:*:*:*:* |
| freetype | freetype | 2.0.3 | cpe:2.3:a:freetype:freetype:2.0.3:*:*:*:*:*:*:* |
| freetype | freetype | 2.0.4 | cpe:2.3:a:freetype:freetype:2.0.4:*:*:*:*:*:*:* |
| freetype | freetype | 2.0.5 | cpe:2.3:a:freetype:freetype:2.0.5:*:*:*:*:*:*:* |
| freetype | freetype | 2.0.6 | cpe:2.3:a:freetype:freetype:2.0.6:*:*:*:*:*:*:* |
| freetype | freetype | 2.0.7 | cpe:2.3:a:freetype:freetype:2.0.7:*:*:*:*:*:*:* |
Related
openvas
openvas
Fedora Update for mingw-freetype FEDORA-2014-17550
2015-01-05 00:00:00
Fedora Update for freetype FEDORA-2014-16840
2015-01-05 00:00:00
Slackware: Security Advisory (SSA:2015-016-01)
2022-04-21 00:00:00
fedora
fedora
[SECURITY] Fedora 21 Update: mingw-freetype-2.5.4-1.fc21
2015-01-02 05:01:40
[SECURITY] Fedora 21 Update: freetype-2.5.3-13.fc21
2014-12-23 18:31:38
[SECURITY] Fedora 20 Update: freetype-2.5.0-7.fc20
2015-01-03 19:05:23
nessus
nessus
Fedora 21 : mingw-freetype-2.5.4-1.fc21 (2014-17550)
2015-01-02 00:00:00
Fedora 20 : freetype-2.5.0-7.fc20 (2014-16854)
2015-01-05 00:00:00
gentoo
gentoo
FreeType: Arbitrary code execution
2014-08-09 00:00:00
prion
prion
Stack overflow
2014-03-12 14:55:00
Stack overflow
2015-02-08 11:59:00
freebsd
freebsd
freetype -- Out of bounds stack-based read/write
2014-12-07 00:00:00
mageia
mageia
Updated freetype2 packages fix security vulnerability
2014-12-13 23:16:05
Updated freetype2 packages fix security vulnerabilities
2014-03-15 20:26:54
debiancve
debiancve
CVE-2014-2240
2014-03-12 14:55:30
CVE-2014-9659
2015-02-08 11:59:21
nvd
nvd
CVE-2014-2240
2014-03-12 14:55:30
CVE-2014-9659
2015-02-08 11:59:21
seebug
seebug
FreeType 'src/cff/cf2hints.c'θΏη¨ζ ηΌε²εΊζΊ’εΊζΌζ΄
2014-03-11 00:00:00
slackware
slackware
[slackware-security] freetype
2015-01-17 06:43:52
cvelist
cvelist
CVE-2014-2240
2014-03-12 14:00:00
CVE-2014-9659
2015-02-08 11:00:00
ubuntucve
ubuntucve
CVE-2014-9659
2015-02-08 00:00:00
CVE-2014-2240
2014-03-12 00:00:00
securityvulns
securityvulns
FreeType memory corruption
2014-03-18 00:00:00
[USN-2148-1] FreeType vulnerabilities
2014-03-18 00:00:00
ubuntu
ubuntu
FreeType vulnerabilities
2014-03-17 00:00:00
cve
cve
CVE-2014-9659
2015-02-08 11:59:21
f5
f5
K16380 : FreeType vulnerabilities CVE-2014-9656 and CVE-2014-9659
2015-04-09 00:00:00
SOL16380 - FreeType vulnerabilities CVE-2014-9656 and CVE-2014-9659
2015-04-09 00:00:00
osv
osv
ft2demos-2.7-1.1 on GA media
2024-06-15 00:00:00
freetype2-devel-2.7-1.1 on GA media
2024-06-15 00:00:00
CVSS2
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
AI Score
7.8
Confidence
Low
EPSS
0.139
Percentile
95.7%
Related for CVE-2014-2240