K16380 : FreeType vulnerabilities CVE-2014-9656 and CVE-2014-9659

Security Advisory Description

• CVE-2014-9656
  
  The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType before 2.5.4 does not properly check for an integer overflow, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted OpenType font.

• CVE-2014-9659
  
  cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint mask has been computed, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted OpenType font. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2240.

Impact

A remote attacker may be able to execute arbitrary code or cause a denial-of-service (DoS) via a crafted OpenType font.