CVE-2010-1797: Buffer Overflow
Multiple stack overflow flaws have been reported in the way FreeType font rendering engine processed certain CFF opcodes. An attacker could use these flaws to create a specially-crafted font file that, when opened, would cause an application linked against libfreetype to crash, or, possibly execute arbitrary code.
References: [1] http://www.f-secure.com/weblog/archives/00002002.html
Acknowledgements:
Red Hat would like to thank Braden Thomas of the Apple Product Security team for reporting these issues.
Other sources
Multiple stack-based buffer overflows in the cffdecoderparsecharstrings function in the CFF Type2 CharStrings interpreter in cff/cffgload.c in FreeType before 2.4.2, as used in Apple iOS before 4.0.2 on the iPhone and iPod touch and before 3.2.2 on the iPad, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted CFF opcodes in embedded fonts in a PDF document, as demonstrated by JailbreakMe. NOTE: some of these details are obtained from third party information.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1797?
CVE-2010-1797 has a high severity rating due to allowing remote attackers to execute arbitrary code on affected devices.
How do I fix CVE-2010-1797?
To fix CVE-2010-1797, upgrade to FreeType version 2.4.2 or later.
Which devices are affected by CVE-2010-1797?
CVE-2010-1797 affects various Apple iOS versions running on devices like iPhone, iPod touch, and iPad.
What type of vulnerability is CVE-2010-1797?
CVE-2010-1797 is classified as a stack-based buffer overflow vulnerability.
When was CVE-2010-1797 disclosed?
CVE-2010-1797 was disclosed in August 2010.