4.3

CVE-2014-9670

Exploit

Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer overflow, NULL pointer dereference, and application crash) via a crafted PCF file that specifies negative values for the first column and first row.

Data is provided by the National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version7.0
Opensuse ≫ Opensuse Version13.1
Opensuse ≫ Opensuse Version13.2
Fedoraproject ≫ Fedora Version20
Fedoraproject ≫ Fedora Version21
Oracle ≫ Solaris Version10.0
Oracle ≫ Solaris Version11.2
Canonical ≫ Ubuntu Linux Version10.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version12.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version14.10
Canonical ≫ Ubuntu Linux Version15.04
Freetype ≫ Freetype Version <= 2.5.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 5.05% 0.894
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:N/A:P