CVE-2009-0946: Integer Overflow
Published Mar 20, 2009
·Updated
Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.
Affected Software
25 affected componentsFixes available
redhat/freetype<0:2.0.3-17.el21
0:2.0.3-17.el21
redhat/freetype<0:2.1.4-12.el3
0:2.1.4-12.el3
redhat/freetype<0:2.1.9-10.el4.7
0:2.1.9-10.el4.7
redhat/freetype<0:2.2.1-21.el5_3
0:2.2.1-21.el5_3
FreeType FreeType<=2.3.9
Debian Debian Linux=5.0
Debian Debian Linux=4.0
Debian Debian Linux=6.0
Canonical Ubuntu Linux=9.04
Canonical Ubuntu Linux=8.10
Canonical Ubuntu Linux=8.04
Canonical Ubuntu Linux=6.06
openSUSE openSUSE=11.1
openSUSE openSUSE=11.0
openSUSE openSUSE=10.3
SUSE Linux Enterprise Server=11
SUSE Linux Enterprise Server=10
Apple iOS and macOS=10.5.8
Apple Mac OS X Server=10.4.11
Apple Mac OS X Server=10.5.8
Apple Safari=4.0
Apple iOS and macOS=10.4.11
Apple iPhone OS>=1.0.0<=2.2.1
Apple Mac OS X Server>=10.6.0<=10.6.4
Apple iOS and macOS>=10.6.0<=10.6.4
Remediation
Patch Available
Event History
Mar 20, 2009
CVE Published
via Red Hat·12:00 AM
Data Sourced
via Red Hat·05:55 PM
DescriptionSeverityAffected Software
Apr 17, 2009
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
1
What is the severity of CVE-2009-0946?
CVE-2009-0946 is rated as critical due to its potential to allow remote code execution.
2
How do I fix CVE-2009-0946?
To fix CVE-2009-0946, upgrade FreeType to version 2.0.3-17.el21 or later.
3
Which versions of FreeType are affected by CVE-2009-0946?
FreeType versions up to and including 2.3.9 are affected by CVE-2009-0946.
4
Can CVE-2009-0946 affect non-Linux systems?
Yes, CVE-2009-0946 can affect systems running FreeType on multiple platforms, including macOS and Windows.
5
What types of attacks can CVE-2009-0946 facilitate?
CVE-2009-0946 can facilitate remote attackers executing arbitrary code through specific crafted input.