CVE-2010-2520: Buffer Overflow
Heap-based buffer overflow in the InsIUP function in truetype/ttinterp.c in FreeType before 2.4.0, when TrueType bytecode support is enabled, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.
Other sources
Robert Swiecki reported a heap buffer overflow vulnerability in freetype's truetype bytecode support. This could cause applications linked against freetype to crash or, possibly, lead to the execution of arbitrary code if an attacker were able to get a victim to load a malicious font file.
The affected functionality (truetype bytecode) is not compiled in Red Hat Enterprise Linux or Fedora by default.
This issue has been given the name CVE-2010-2520.
Upstream bug reports:
http://savannah.nongnu.org/bugs/index.php?30361
Upstream commit that fixes the issue:
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=888cd1843e935fe675cf2ac303116d4ed5b9d54b
Statement:
Not vulnerable. This issue did not affect the versions of freetype as shipped with Red Hat Enterprise Linux 3, 4, or 5.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2520?
CVE-2010-2520 has a moderate severity level, as it can lead to denial of service or potentially arbitrary code execution.
How do I fix CVE-2010-2520?
To fix CVE-2010-2520, you should update FreeType to version 2.4.0 or later.
What software is affected by CVE-2010-2520?
CVE-2010-2520 affects FreeType before version 2.4.0 and various versions of Ubuntu, Debian, and macOS.
What type of vulnerability is CVE-2010-2520?
CVE-2010-2520 is a heap-based buffer overflow vulnerability.
Can CVE-2010-2520 be exploited remotely?
Yes, CVE-2010-2520 can be exploited remotely through crafted font files.