SB2016060709 - Input validation error in Debian Linux

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016060709

SB2016060709 - Input validation error in Debian Linux

Published: June 7, 2016 Updated: August 9, 2020

Security Bulletin ID SB2016060709
Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Input validation error (CVE-ID: CVE-2014-9746)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The (1) t1_parse_font_matrix function in type1/t1load.c, (2) cid_parse_font_matrix function in cid/cidload.c, (3) t42_parse_font_matrix function in type42/t42parse.c, and (4) ps_parser_load_field function in psaux/psobjs.c in FreeType before 2.5.4 do not check return values, which allows remote attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted font.


Remediation

Install update from vendor's website.

References