CVE-2014-9675
Fixed in a distro release EPSS 4%
bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font.
Products: canonical ubuntu_linux, freetype, debian_linux, fedoraproject fedora, redhat enterprise_linux_desktop, redhat enterprise_linux_hpc_node, redhat enterprise_linux_hpc_node_eus, redhat enterprise_linux_server, redhat enterprise_linux_server_eus, redhat enterprise_linux_workstation, opensuse
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | freetype | 2.5.2-3 |
| Debian 13 | freetype | 2.5.2-3 |
| Debian 14 | freetype | 2.5.2-3 |
| Debian 6.0 | freetype | 2.4.2-2.1+squeeze5 |
| Debian 7 | freetype | 2.4.9-1.1+deb7u1 |
| Red Hat Enterprise Linux 6 | freetype | 0:2.3.11-15.el6_6.1 |
| Red Hat Enterprise Linux 6 | freetype-debuginfo | 0:2.3.11-15.el6_6.1 |
| Red Hat Enterprise Linux 6 | freetype-demos | 0:2.3.11-15.el6_6.1 |
| Red Hat Enterprise Linux 6 | freetype-devel | 0:2.3.11-15.el6_6.1 |
| Red Hat Enterprise Linux 7 | freetype | 0:2.4.11-10.ael7b_1.1 |
| Red Hat Enterprise Linux 7 | freetype | 0:2.4.11-10.el7_1.1 |
| Red Hat Enterprise Linux 7 | freetype-debuginfo | 0:2.4.11-10.ael7b_1.1 |
| Red Hat Enterprise Linux 7 | freetype-debuginfo | 0:2.4.11-10.el7_1.1 |
| Red Hat Enterprise Linux 7 | freetype-demos | 0:2.4.11-10.ael7b_1.1 |
| Red Hat Enterprise Linux 7 | freetype-demos | 0:2.4.11-10.el7_1.1 |
| Red Hat Enterprise Linux 7 | freetype-devel | 0:2.4.11-10.el7_1.1 |
| Red Hat Enterprise Linux 7 | freetype-devel | 0:2.4.11-10.ael7b_1.1 |
| SUSE Linux Enterprise Desktop 12 | freetype2 | 2.5.3-5.1 |
| SUSE Linux Enterprise Desktop 12 | ft2demos | 2.5.3-5.1 |
| SUSE Linux Enterprise Server 12 | freetype2 | 2.5.3-5.1 |
| SUSE Linux Enterprise Server 12 | ft2demos | 2.5.3-5.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | freetype2 | 2.5.3-5.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | ft2demos | 2.5.3-5.1 |
| SUSE Linux Enterprise Software Development Kit 12 | freetype2 | 2.5.3-5.1 |
| Ubuntu 14.04 LTS | freetype | 2.5.2-1ubuntu2.4 |
| openSUSE Tumbleweed | freetype2 | 2.7-1.1 |
| openSUSE Tumbleweed | ft2demos | 2.7-1.1 |