Out-of-bounds write in FreeType Demo Programs - CVE-2022-31782

Vulnerability identifier: #VU65644

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-31782

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in ftbench.c. A remote attacker can trigger out-of-bounds write and execute arbitrary code on the target system.

FreeType Demo Programs
cflinuxfs3
Ubuntu
openEuler
libfreetype6 (Ubuntu package)
freetype-help
freetype-devel
freetype-demos
freetype-debugsource
freetype-debuginfo
freetype
HPE Moonshot 1500 Chassis Manager

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

cflinuxfs3 - update to 0.312.0
libfreetype6 (Ubuntu package) - addressed in versions 2.8.1-2ubuntu2.2, 2.10.1-2ubuntu0.2, 2.11.1+dfsg-1ubuntu0.1
freetype-help - update to 2.12.1-6
freetype-devel - update to 2.12.1-6
freetype-demos - update to 2.12.1-6
freetype-debugsource - update to 2.12.1-6
freetype-debuginfo - update to 2.12.1-6
freetype - update to 2.12.1-6
HPE Moonshot 1500 Chassis Manager - update to 4.0-b43

• https://gitlab.freedesktop.org/freetype/freetype-demos/-/issues/8

• Out-of-bounds write in FreeType Demo Programs
• Multiple vulnerabilities in cflinuxfs3
• Ubuntu update for freetype
• Multiple vulnerabilities in HPE Moonshot 1500 Chassis Manager
• openEuler 22.03 LTS SP4 update for freetype
• openEuler 22.03 LTS SP3 update for freetype