CVE-2010-2497

MEDIUM 6.8CVE-2010-2497 · Published 19/08/2010 · updated 16/06/2026

In short

CVE-2010-2497 is a MEDIUM (CVSS 6.8) vulnerability affecting freetype (freetype).
Chance of exploitation in the next 30 days (EPSS): 5.6%, higher than 92.9% of all vulnerabilities.
Fix: update to 2.4.0 or later.

Package	Affected versions	Patched versions
freetype freetype	`< 2.4.0`	`2.4.0`

Description

Integer underflow in glyph handling in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.

References

git.savannah.gnu.org/cgit/freetype/freetype2.git/commit · Patch
lists.apple.com/archives/security-announce/2010//Nov/msg00000.html · Mailing List
lists.nongnu.org/archive/html/freetype/2010-07/msg00001.html · Mailing List
marc.info · Mailing List
marc.info · Mailing List
secunia.com/advisories/48951 · Third Party Advisory
support.apple.com/kb/HT4435 · Broken Link
debian.org/security/2010/dsa-2070 · Third Party Advisory
mandriva.com/security/advisories · Third Party Advisory
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
savannah.nongnu.org/bugs · Exploit
savannah.nongnu.org/bugs · Exploit

More vulnerabilities in freetype

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

freetype

< 2.4.0

2.4.0

More vulnerabilities in freetype

See all →