CVE-2010-2519

MEDIUM 6.8CVE-2010-2519 · Published 19/08/2010 · updated 16/06/2026

In short

CVE-2010-2519 is a MEDIUM (CVSS 6.8) vulnerability affecting freetype (freetype).
Chance of exploitation in the next 30 days (EPSS): 6.3%, higher than 93.6% of all vulnerabilities.
Fix: update to 2.4.0 or later.

Package	Affected versions	Patched versions
freetype freetype	`< 2.4.0`	`2.4.0`

Description

Heap-based buffer overflow in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted length value in a POST fragment header in a font file.

References

git.savannah.gnu.org/cgit/freetype/freetype2.git/commit · Patch
git.savannah.gnu.org/cgit/freetype/freetype2.git/commit · Patch
lists.apple.com/archives/security-announce/2010//Nov/msg00000.html · Mailing List
lists.nongnu.org/archive/html/freetype/2010-07/msg00001.html · Mailing List
marc.info · Mailing List
marc.info · Mailing List
secunia.com/advisories/48951 · Third Party Advisory
securitytracker.com/id · Third Party Advisory
support.apple.com/kb/HT4435 · Broken Link
debian.org/security/2010/dsa-2070 · Third Party Advisory
mandriva.com/security/advisories · Third Party Advisory

More vulnerabilities in freetype

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

freetype

< 2.4.0

2.4.0

More vulnerabilities in freetype

See all →