K72372334 : FreeType vulnerability CVE-2014-9745

2016-09-2800:00:00

my.f5.com

7.4 High

AI Score

Confidence

High

0.066 Low

EPSS

Percentile

93.8%

JSON

Security Advisory Description

The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a “broken number-with-base” in a Postscript stream, as demonstrated by 8#garbage. (CVE-2014-9745)
Impact
A remote attacker may be able to cause a denial-of-service (DoS) attack for an ARX system via a crafted Postscript stream.

CPENameOperatorVersion
big-ip afmeq11.4.0
big-ip afmeq11.4.1
big-ip afmeq11.5.0
big-ip afmeq11.5.1
big-ip afmeq11.5.2
big-ip afmeq11.5.3
big-ip afmeq11.5.4
big-ip afmeq11.6.0
big-ip afmeq11.6.1
big-ip afmeq12.0.0

Name	Operator	Version
big-ip afm	eq	11.4.0
big-ip afm	eq	11.4.1
big-ip afm	eq	11.5.0
big-ip afm	eq	11.5.1
big-ip afm	eq	11.5.2
big-ip afm	eq	11.5.3
big-ip afm	eq	11.5.4
big-ip afm	eq	11.6.0
big-ip afm	eq	11.6.1
big-ip afm	eq	12.0.0