CVE-2010-3814

Published: Nov 26, 2010Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Heap-based buffer overflow in the Ins_SHZ function in ttinterp.c in FreeType 2.4.3 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted SHZ bytecode instruction, related to TrueType opcodes, as demonstrated by a PDF document with a crafted embedded font.

Affected (33)

Products: Freetype: Freetype

1 product

Configuration A

33 vulnerable

Vulnerable Software	Affected Versions
Freetype Freetype	Up to 2.4.3
Freetype Freetype	Version 1.3.1
Freetype Freetype	Version 2.0.6
Freetype Freetype	Version 2.0.9
Freetype Freetype	Version 2.1.10
Freetype Freetype	Version 2.1.3
Freetype Freetype	Version 2.1.4
Freetype Freetype	Version 2.1.5
Freetype Freetype	Version 2.1.6
Freetype Freetype	Version 2.1.7
Freetype Freetype	Version 2.1.8
Freetype Freetype	Version 2.1.8 rc1
Freetype Freetype	Version 2.1.9
Freetype Freetype	Version 2.1
Freetype Freetype	Version 2.2.0
Freetype Freetype	Version 2.2.10
Freetype Freetype	Version 2.2.1
Freetype Freetype	Version 2.3.0
Freetype Freetype	Version 2.3.10
Freetype Freetype	Version 2.3.11
Freetype Freetype	Version 2.3.12
Freetype Freetype	Version 2.3.1
Freetype Freetype	Version 2.3.2
Freetype Freetype	Version 2.3.3
Freetype Freetype	Version 2.3.4
Freetype Freetype	Version 2.3.5
Freetype Freetype	Version 2.3.6
Freetype Freetype	Version 2.3.7
Freetype Freetype	Version 2.3.8
Freetype Freetype	Version 2.3.9
Freetype Freetype	Version 2.4.0
Freetype Freetype	Version 2.4.1
Freetype Freetype	Version 2.4.2

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (34)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=602221

Source: product-security@apple.com

http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0edf0986f3be570f5bf90ff245a85c1675f5c9a4

Source: product-security@apple.com

http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html

Source: product-security@apple.com

Vendor Advisory

http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html

Source: product-security@apple.com

http://secunia.com/advisories/42314

Source: product-security@apple.com

http://secunia.com/advisories/43138

Source: product-security@apple.com

http://secunia.com/advisories/48951

Source: product-security@apple.com

http://security-tracker.debian.org/tracker/CVE-2010-3814

Source: product-security@apple.com

http://support.apple.com/kb/HT4456

Source: product-security@apple.com

Vendor Advisory

http://support.apple.com/kb/HT4581

Source: product-security@apple.com

http://www.debian.org/security/2011/dsa-2155

Source: product-security@apple.com

http://www.mandriva.com/security/advisories?name=MDVSA-2010:236

Source: product-security@apple.com

http://www.securityfocus.com/bid/44643

Source: product-security@apple.com

http://www.securitytracker.com/id?1024767

Source: product-security@apple.com

http://www.ubuntu.com/usn/USN-1013-1

Source: product-security@apple.com

http://www.vupen.com/english/advisories/2010/3046

Source: product-security@apple.com

http://www.vupen.com/english/advisories/2011/0246

Source: product-security@apple.com

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=602221

Source: af854a3a-2127-422b-91ae-364da2661108

http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0edf0986f3be570f5bf90ff245a85c1675f5c9a4

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/42314

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/43138

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/48951

Source: af854a3a-2127-422b-91ae-364da2661108

http://security-tracker.debian.org/tracker/CVE-2010-3814

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.apple.com/kb/HT4456

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://support.apple.com/kb/HT4581

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2011/dsa-2155

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2010:236

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/44643

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1024767

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1013-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/3046

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0246

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.