FreeType tt_cmap4_validate DoS Vulnerability

FreeType tt_cmap4_validate DoS Vulnerability

Release date:
Updated on:

Affected Systems:
FreeType <2.5.4
Description:
CVE (CAN) ID: CVE-2014-9663

FreeType is a popular font function library.

FreeType 2.5.4 or earlier, sfnt/ttcmap. c's tt_cmap4_validate function calculates some uncompleted length fields. Remote attackers can exploit this vulnerability to cause Denial-of-Service (out-of-range read) by constructing a cmap sfnt table ).

<* Source: vendor
*>

Suggestion:
Vendor patch:

FreeType
--------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://code.google.com/p/google-security-research/issues/detail? Id = 184
Http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit? Id = 9bd20b7304aae61de5d50ac359cf27132bafd4c1

This article permanently updates the link address: