CVE-2010-2499: Buffer Overflow
Buffer overflow in the MacReadPOSTResource function in base/ftobjs.c in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted LaserWriter PS font file with an embedded PFB fragment.
Other sources
Robert Swiecki reported a buffer overflow flaw in freetype with how it handles certain fonts. This could cause applications linked against freetype to crash or, possibly, lead to the execution of arbitrary code if an attacker were able to get a victim to load a malicious font file.
The affected code is not present in Red Hat Enterprise Linux 3 (freetype 2.1.4). This issue does cause a crash on Red Hat Enterprise Linux 4 and 5.
This issue has been given the name CVE-2010-2499.
Upstream bug reports:
http://savannah.nongnu.org/bugs/index.php?30248 http://savannah.nongnu.org/bugs/index.php?30249
Upstream commits that fix the issue:
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=c69891a1345640096fbf396e8dd567fe879ce233 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=f29f741efbba0a5ce2f16464f648fb8d026ed4c8
Acknowledgements:
Red Hat would like to thank Robert Święcki of the Google Security Team for the discovery of this issue.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2499?
CVE-2010-2499 has a high severity rating due to its potential to cause application crashes and execute arbitrary code.
How do I fix CVE-2010-2499?
To fix CVE-2010-2499, you need to upgrade FreeType to version 2.4.0 or later.
Which software versions are affected by CVE-2010-2499?
CVE-2010-2499 affects FreeType versions prior to 2.4.0 and specific versions of Ubuntu Linux, Debian, and macOS.
What type of attack is possible with CVE-2010-2499?
CVE-2010-2499 allows remote attackers to conduct denial of service attacks or potentially execute arbitrary code using crafted font files.
Is CVE-2010-2499 related to any specific file type?
Yes, CVE-2010-2499 exploits a vulnerability in processing crafted LaserWriter PS font files with embedded PFB fragments.