CVE-2010-2807

MEDIUM 6.8CVE-2010-2807 · Published 19/08/2010 · updated 16/06/2026

In short

CVE-2010-2807 is a MEDIUM (CVSS 6.8) vulnerability affecting freetype (freetype).
Chance of exploitation in the next 30 days (EPSS): 4.2%, higher than 91.0% of all vulnerabilities.
Fix: update to 2.4.2 or later.

Package	Affected versions	Patched versions
freetype freetype	`< 2.4.2`	`2.4.2`

Description

FreeType before 2.4.2 uses incorrect integer data types during bounds checking, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.

References

freetype.sourceforge.net/index2.html · Release Notes
git.savannah.gnu.org/cgit/freetype/freetype2.git/commit · Patch
lists.apple.com/archives/security-announce/2010//Nov/msg00000.html · Mailing List
lists.apple.com/archives/security-announce/2010//Nov/msg00003.html · Mailing List
marc.info · Mailing List
secunia.com/advisories/40816 · Third Party Advisory
secunia.com/advisories/40982 · Third Party Advisory
secunia.com/advisories/42314 · Third Party Advisory
secunia.com/advisories/42317 · Third Party Advisory
sourceforge.net/projects/freetype/files/freetype2/2.4.2/NEWS/view · Product
support.apple.com/kb/HT4435 · Broken Link

More vulnerabilities in freetype

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

freetype

< 2.4.2

2.4.2

More vulnerabilities in freetype

See all →