CVE-2010-3855

Published: Nov 26, 2010Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Buffer overflow in the ft_var_readpackedpoints function in truetype/ttgxvar.c in FreeType 2.4.3 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TrueType GX font.

Affected (32)

Products: Freetype: Freetype

Freetype

1 product

Freetype

Configuration A

32 vulnerable

Vulnerable Software	Affected Versions
Freetype Freetype	Up to 2.4.3
Freetype Freetype	Version 1.3.1
Freetype Freetype	Version 2.0.6
Freetype Freetype	Version 2.0.9
Freetype Freetype	Version 2.1.10
Freetype Freetype	Version 2.1.3
Freetype Freetype	Version 2.1.4
Freetype Freetype	Version 2.1.5
Freetype Freetype	Version 2.1.6
Freetype Freetype	Version 2.1.7
Freetype Freetype	Version 2.1.8
Freetype Freetype	Version 2.1.9
Freetype Freetype	Version 2.1
Freetype Freetype	Version 2.2.0
Freetype Freetype	Version 2.2.10
Freetype Freetype	Version 2.2.1
Freetype Freetype	Version 2.3.0
Freetype Freetype	Version 2.3.10
Freetype Freetype	Version 2.3.11
Freetype Freetype	Version 2.3.12
Freetype Freetype	Version 2.3.1
Freetype Freetype	Version 2.3.2
Freetype Freetype	Version 2.3.3
Freetype Freetype	Version 2.3.4
Freetype Freetype	Version 2.3.5
Freetype Freetype	Version 2.3.6
Freetype Freetype	Version 2.3.7
Freetype Freetype	Version 2.3.8
Freetype Freetype	Version 2.3.9
Freetype Freetype	Version 2.4.0
Freetype Freetype	Version 2.4.1
Freetype Freetype	Version 2.4.2

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (60)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=602221

Source: secalert@redhat.com

http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=59eb9f8cfe7d1df379a2318316d1f04f80fba54a

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2011//Jul/msg00000.html

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2011//Jul/msg00001.html

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2011//Mar/msg00005.html

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050965.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051231.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051251.html

Source: secalert@redhat.com

http://secunia.com/advisories/42289

Source: secalert@redhat.com

http://secunia.com/advisories/42295

Source: secalert@redhat.com

http://secunia.com/advisories/43138

Source: secalert@redhat.com

http://secunia.com/advisories/48951

Source: secalert@redhat.com

http://support.apple.com/kb/HT4564

Source: secalert@redhat.com

http://support.apple.com/kb/HT4565

Source: secalert@redhat.com

http://support.apple.com/kb/HT4581

Source: secalert@redhat.com

http://support.apple.com/kb/HT4802

Source: secalert@redhat.com

http://support.apple.com/kb/HT4803

Source: secalert@redhat.com

http://support.avaya.com/css/P8/documents/100122733

Source: secalert@redhat.com

http://www.debian.org/security/2011/dsa-2155

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2010:235

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2010:236

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2010-0889.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/44214

Source: secalert@redhat.com

http://www.securitytracker.com/id?1024745

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1013-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/3037

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0246

Source: secalert@redhat.com

https://savannah.nongnu.org/bugs/?31310

Source: secalert@redhat.com

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=602221