CVE-2014-9675

Exploit

EPSS 2.11%
Published 08.02.2015 11:59:36
Last modified 12.04.2025 10:46:40
Source cve@mitre.org
Teams watchlist Login
Open Login

bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font.

Affected products Warnungen 0 Metrics 2 CWE 0 References 18

Data is provided by the National Vulnerability Database (NVD)

Canonical ≫ Ubuntu Linux Version10.04 SwEditionlts

Canonical ≫ Ubuntu Linux Version12.04 SwEditionlts

Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts

Canonical ≫ Ubuntu Linux Version14.10

Canonical ≫ Ubuntu Linux Version15.04

Freetype ≫ Freetype Version <= 2.5.3

Debian ≫ Debian Linux Version7.0

Fedoraproject ≫ Fedora Version20

Fedoraproject ≫ Fedora Version21

Redhat ≫ Enterprise Linux Desktop Version6.0

Redhat ≫ Enterprise Linux Desktop Version7.0

Redhat ≫ Enterprise Linux Hpc Node Version6.0

Redhat ≫ Enterprise Linux Hpc Node Version7.0

Redhat ≫ Enterprise Linux Hpc Node Eus Version7.1

Redhat ≫ Enterprise Linux Server Version6.0

Redhat ≫ Enterprise Linux Server Version7.0

Redhat ≫ Enterprise Linux Server Eus Version6.6.z

Redhat ≫ Enterprise Linux Server Eus Version7.1

Redhat ≫ Enterprise Linux Workstation Version6.0

Redhat ≫ Enterprise Linux Workstation Version7.0

Opensuse ≫ Opensuse Version13.1

Opensuse ≫ Opensuse Version13.2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	2.11%	0.835

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N

http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html

Third Party Advisory

http://www.ubuntu.com/usn/USN-2739-1

Third Party Advisory

https://source.android.com/security/bulletin/2016-11-01.html

http://advisories.mageia.org/MGASA-2015-0083.html

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150148.html

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150162.html

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2015-03/msg00091.html

Third Party Advisory

http://www.debian.org/security/2015/dsa-3188

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2015:055

Third Party Advisory

http://www.securityfocus.com/bid/72986

http://www.ubuntu.com/usn/USN-2510-1

Third Party Advisory

https://security.gentoo.org/glsa/201503-05

http://rhn.redhat.com/errata/RHSA-2015-0696.html

Third Party Advisory

http://code.google.com/p/google-security-research/issues/detail?id=151

Exploit

http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=2c4832d30939b45c05757f0a05128ce64c4cacc7

Issue Tracking

https://nvd.nist.gov/vuln/detail/CVE-2014-9675

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2014-9675

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2014-9675

EUVD