Fluid Attacks Database

Description

bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 14	freetype	>=0 <2.5.2-3	2.5.2-3
debian 12	freetype	>=0 <2.5.2-3	2.5.2-3
debian 11	freetype	>=0 <2.5.2-3	2.5.2-3
debian 13	freetype	>=0 <2.5.2-3	2.5.2-3
rpm rhel5	freetype	-	-
rpm rhel7	freetype	<0:2.4.11-10.el7_1.1	0:2.4.11-10.el7_1.1
rpm rhel6	freetype	<0:2.3.11-15.el6_6.1	0:2.3.11-15.el6_6.1

Aliases

1. CVE-2014-96752. NVD-2014-96753. OSV-DEBIAN-2014-96754. OSV-2014-96755. SECURITY-TRACKER-CVE-2014-9675

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.