CVE-2014-9668

The woff_open_font function in sfnt/sfobjs.c in FreeType before 2.5.4
proceeds with offset+length calculations without restricting length values,
which allows remote attackers to cause a denial of service (integer
overflow and heap-based buffer overflow) or possibly have unspecified other
impact via a crafted Web Open Font Format (WOFF) file.

Bugs

• <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777656&gt;
• <http://code.google.com/p/google-security-research/issues/detail?id=164&gt;
• <http://savannah.nongnu.org/bugs/?43589&gt;