CVE-2009-0946

Published: Apr 17, 2009Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.

Affected (21)

Products: Freetype: Freetype · Debian: Debian Linux · Canonical: Ubuntu Linux · +3 more

Show all products

Freetype: Freetype · Debian: Debian Linux · Canonical: Ubuntu Linux · Opensuse: Opensuse · Suse: Linux Enterprise Server · Apple: Iphone Os, Mac Os X, Mac Os X Server, Safari

1 product

1 product

1 product

1 product

1 product

Linux Enterprise Server

4 products

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Freetype Freetype	Up to 2.3.9

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 4.0
Debian Debian Linux	Version 5.0
Debian Debian Linux	Version 6.0

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 8.10
Canonical Ubuntu Linux	Version 9.04

Configuration D

5 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 10.3
Opensuse Opensuse	Version 11.0
Opensuse Opensuse	Version 11.1
Suse Linux Enterprise Server	Version 10
Suse Linux Enterprise Server	Version 11

Configuration E

8 vulnerable

Vulnerable Software	Affected Versions
Apple Iphone Os	From 1.0.0 to 2.2.1
Apple Mac Os X	From 10.6.0 to 10.6.4
Apple Mac Os X	Version 10.4.11
Apple Mac Os X	Version 10.5.8
Apple Mac Os X Server	From 10.6.0 to 10.6.4
Apple Mac Os X Server	Version 10.4.11
Apple Mac Os X Server	Version 10.5.8
Apple Safari	Version 4.0

Related CWEs

CWE-190

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (78)

http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0545ec1ca36b27cb928128870a83e5f668980bc5

Source: cve@mitre.org

PatchThird Party Advisory

http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=79972af4f0485a11dcb19551356c45245749fc5b

Source: cve@mitre.org

PatchThird Party Advisory

http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=a18788b14db60ae3673f932249cd02d33a227c4e

Source: cve@mitre.org

PatchThird Party Advisory

http://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/ChangeLog

Source: cve@mitre.org

Release NotesThird Party Advisory

http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html

Source: cve@mitre.org

Broken Link

http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://secunia.com/advisories/34723

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/34913

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/34967

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/35065

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/35074

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/35198

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/35200

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/35204

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/35210

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/35379

Source: cve@mitre.org

Third Party Advisory

http://security.gentoo.org/glsa/glsa-200905-05.xml

Source: cve@mitre.org

Third Party Advisory

http://sunsolve.sun.com/search/document.do?assetkey=1-66-270268-1

Source: cve@mitre.org

Broken Link

http://support.apple.com/kb/HT3549

Source: cve@mitre.org

Third Party Advisory

http://support.apple.com/kb/HT3613

Source: cve@mitre.org

Third Party Advisory

http://support.apple.com/kb/HT3639

Source: cve@mitre.org

Third Party Advisory

http://support.apple.com/kb/HT4435

Source: cve@mitre.org

Broken Link

http://www.debian.org/security/2009/dsa-1784

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2009:243

Source: cve@mitre.org

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2009-0329.html

Source: cve@mitre.org

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2009-1061.html

Source: cve@mitre.org

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2009-1062.html

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/bid/34550

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-767-1

Source: cve@mitre.org

Third Party Advisory

http://www.us-cert.gov/cas/techalerts/TA09-133A.html

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

http://www.vupen.com/english/advisories/2009/1058

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2009/1297

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2009/1522

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2009/1621

Source: cve@mitre.org

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=491384

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10149

Source: cve@mitre.org

Third Party Advisory

http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0545ec1ca36b27cb928128870a83e5f668980bc5