CVE-2010-2527: Buffer Overflow
Multiple buffer overflows in demo programs in FreeType before 2.4.0 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.
Other sources
Robert Swiecki reported multiple buffer overflows in the freetype demo applications. The demo application could crash or, possibly, lead to the execution of arbitrary code if an attacker were able to get a victim to load a malicious font file.
This is CVE-2010-2527 http://savannah.nongnu.org/bugs/index.php?30054
The fix is here: http://git.savannah.gnu.org/cgit/freetype/freetype2-demos.git/commit/?id=b995299b73ba4cd259f221f500d4e63095508bec
Acknowledgements:
Red Hat would like to thank Robert Święcki of the Google Security Team for the discovery of these issues.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2527?
CVE-2010-2527 is classified as a high severity vulnerability due to its potential to cause denial of service or arbitrary code execution.
How do I fix CVE-2010-2527?
To fix CVE-2010-2527, upgrade FreeType to version 2.4.0 or later.
What types of systems are affected by CVE-2010-2527?
CVE-2010-2527 affects FreeType versions prior to 2.4.0, including specific Debian and Ubuntu Linux distributions.
What is the impact of exploiting CVE-2010-2527?
Exploiting CVE-2010-2527 can lead to application crashes and in some cases, the execution of arbitrary code.
Who reported the CVE-2010-2527 vulnerability?
The vulnerability CVE-2010-2527 was reported by Robert Swiecki.