CVE-2016-10244Out-of-bounds Read in Freetype

Severity
7.8HIGHNVD
EPSS
0.5%
top 33.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMar 6
Latest updateMay 13

Description

The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

debiandebian/freetype< freetype 2.6.3-3.1 (bookworm)
NVDfreetype/freetype< 2.7.1
Debianfreetype/freetype< 2.6.3-3.1+3

Also affects: Debian Linux 8.0

Patches

🔴Vulnerability Details

2
GHSA
GHSA-6vgf-3977-2x4f: The parse_charstrings function in type1/t1load2022-05-13
OSV
CVE-2016-10244: The parse_charstrings function in type1/t1load2017-03-06

📋Vendor Advisories

4
Android
CVE-2016-10244: Android Security Bulletin 2017-04-01 CVE: CVE-2016-10244 Severity: HIGH Affected AOSP versions: 42017-04-01
Ubuntu
FreeType vulnerability2017-03-20
Red Hat
freetype: parse_charstrings function in type1/t1load.c does not ensure that a font contains a glyph name2016-08-25
Debian
CVE-2016-10244: freetype - The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does n...2016

💬Community

4
Bugzilla
CVE-2016-10244 freetype: parse_charstrings function in type1/t1load.c does not ensure that a font contains a glyph name [fedora-all]2017-03-07
Bugzilla
CVE-2016-10244 freetype: parse_charstrings function in type1/t1load.c does not ensure that a font contains a glyph name2017-03-07
Bugzilla
CVE-2016-10244 mingw-freetype: freetype: parse_charstrings function in type1/t1load.c does not ensure that a font contains a glyph name [fedora-all]2017-03-07
Bugzilla
CVE-2016-10244 mingw-freetype: freetype: parse_charstrings function in type1/t1load.c does not ensure that a font contains a glyph name [epel-7]2017-03-07