CVEvulnerability
CVE-2014-9675
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-02-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-264
Description
bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font.
Affected configurations
• canonical ubuntu linux 10.04
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 14.10
• canonical ubuntu linux 15.04
• freetype freetype (<= 2.5.3)
• debian debian linux 7.0
• fedoraproject fedora 20
• fedoraproject fedora 21
• redhat enterprise linux desktop 6.0
• redhat enterprise linux desktop 7.0
• redhat enterprise linux hpc node 6.0
• redhat enterprise linux hpc node 7.0
• redhat enterprise linux hpc node eus 7.1
• redhat enterprise linux server 6.0
• redhat enterprise linux server 7.0
• redhat enterprise linux server eus 6.6.z
• redhat enterprise linux server eus 7.1
• redhat enterprise linux workstation 6.0
• redhat enterprise linux workstation 7.0
• opensuse opensuse 13.1
• opensuse opensuse 13.2
Related
Weakness · not in database (1)
References
- http://advisories.mageia.org/MGASA-2015-0083.html Third Party Advisory
- http://code.google.com/p/google-security-research/issues/detail?id=151 Exploit
- http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=2c4832d30939b45c05757f0a05128ce64c4cacc7 Issue Tracking
- http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150148.html Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150162.html Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-03/msg00091.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0696.html Third Party Advisory
- http://www.debian.org/security/2015/dsa-3188 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:055 Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html Third Party Advisory
- http://www.securityfocus.com/bid/72986 www.securityfocus.com
- http://www.ubuntu.com/usn/USN-2510-1 Third Party Advisory
- http://www.ubuntu.com/usn/USN-2739-1 Third Party Advisory
- https://security.gentoo.org/glsa/201503-05 security.gentoo.org
- https://source.android.com/security/bulletin/2016-11-01.html source.android.com
- http://advisories.mageia.org/MGASA-2015-0083.html Third Party Advisory
- http://code.google.com/p/google-security-research/issues/detail?id=151 Exploit
- http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=2c4832d30939b45c05757f0a05128ce64c4cacc7 Issue Tracking
- http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150148.html Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150162.html Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-03/msg00091.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0696.html Third Party Advisory
- http://www.debian.org/security/2015/dsa-3188 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:055 Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html Third Party Advisory
- http://www.securityfocus.com/bid/72986 www.securityfocus.com
- http://www.ubuntu.com/usn/USN-2510-1 Third Party Advisory
- http://www.ubuntu.com/usn/USN-2739-1 Third Party Advisory
- https://security.gentoo.org/glsa/201503-05 security.gentoo.org
- https://source.android.com/security/bulletin/2016-11-01.html source.android.com