Fluid Attacks Database

Description

FreeType before 2.4.2 uses incorrect integer data types during bounds checking, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 14	freetype	>=0 <2.4.2-1	2.4.2-1
debian 11	freetype	>=0 <2.4.2-1	2.4.2-1
debian 12	freetype	>=0 <2.4.2-1	2.4.2-1
debian 13	freetype	>=0 <2.4.2-1	2.4.2-1

Aliases

1. CVE-2010-28072. NVD-2010-28073. OSV-DEBIAN-2010-28074. OSV-2010-28075. SECURITY-TRACKER-CVE-2010-2807

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.