Buffer overflow in FreeType - CVE-2016-10244

Vulnerability identifier: #VU11093

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-10244

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the The parse_charstrings function in type1/t1load.c due to a boundary error when it does not ensure that a font contains a glyph name. A remote attacker can send a specially crafted file, trigger buffer overflow and cause the service to crash.

FreeType
Debian Linux
Ubuntu
Fedora
freetype (Alpine package)
freetype
Flex System Chassis Management Module (CMM)

Update to version 2.7.

freetype (Alpine package) - update to 2.5.5-r1
Flex System Chassis Management Module (CMM) - update to 2pet16c-2.5.12c
freetype - addressed in versions 2.6.3-3.fc24, 2.6.5-3.fc25

• http://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/ChangeLog?h=VER-2-7

• Ubuntu update for FreeType
• Debian update for freetype
• Buffer overflow in freetype (Alpine package)
• Multiple vulnerabilities in IBM Flex System Chassis Management Module (CMM)
• Fedora 24 update for freetype
• Fedora 25 update for freetype