CVE-2010-2500: Integer Overflow
Integer overflow in the grayrenderspan function in smooth/ftgrays.c in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.
Other sources
Robert Swiecki reported an integer overflow flaw in freetype with how it processes certain fonts. This could cause applications linked against freetype to crash or, possibly, lead to the execution of arbitrary code if an attacker were able to get a victim to load a malicious font file.
The code in question goes back to the version of freetype in Red Hat Enterprise Linux 3, and can only be triggered when MALLOCCHECK=3 is set.
This issue has been given the name CVE-2010-2500.
Upstream bug reports:
http://savannah.nongnu.org/bugs/index.php?30263
Upstream commit that fixes the issue:
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=6305b869d86ff415a33576df6d43729673c66eee
Acknowledgements:
Red Hat would like to thank Robert Święcki of the Google Security Team for the discovery of this issue.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2500?
CVE-2010-2500 has a high severity rating due to its potential to cause a denial of service or allow execution of arbitrary code.
How do I fix CVE-2010-2500?
To fix CVE-2010-2500, update FreeType to version 2.4.0 or later.
What are the affected versions in CVE-2010-2500?
CVE-2010-2500 affects FreeType versions earlier than 2.4.0 and several specific versions of Ubuntu, Debian, and macOS.
What types of attacks can exploit CVE-2010-2500?
Attackers can exploit CVE-2010-2500 through crafted font files that trigger the integer overflow, leading to crashes or arbitrary code execution.
Who reported CVE-2010-2500?
CVE-2010-2500 was reported by Robert Swiecki, who identified the integer overflow flaw in FreeType.