CVE-2014-9675

MOYENNE 5.0CVE-2014-9675 · Published 08/02/2015 · updated 17/06/2026

En bref

CVE-2014-9675 est une vulnérabilité MOYENNE (CVSS 5.0) touchant freetype (freetype).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 4.2%, plus élevée que 90.9% des vulnérabilités.
Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.

Package	Affected versions	Patched versions
freetype freetype	`≤ 2.5.3`	No fix yet

Description

bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font.

References

advisories.mageia.org/MGASA-2015-0083.html · Third Party Advisory
code.google.com/p/google-security-research/issues/detail · Exploit
git.savannah.gnu.org/cgit/freetype/freetype2.git/commit · Issue Tracking
lists.fedoraproject.org/pipermail/package-announce/2015-February/150148.html · Third Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2015-February/150162.html · Third Party Advisory
lists.opensuse.org/opensuse-updates/2015-03/msg00091.html · Third Party Advisory
rhn.redhat.com/errata/RHSA-2015-0696.html · Third Party Advisory
debian.org/security/2015/dsa-3188 · Third Party Advisory
mandriva.com/security/advisories · Third Party Advisory
oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html

Autres vulnérabilités de freetype

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free