CVE-2010-2806: Out-of-bounds Read
An array index error, leading to heap-based buffer overflow was found in the way the FreeType font rendering engine processed FontType42 font files with negative length of certain special font name table strings. An attacker could use this flaw to create a specially-crafted font file (which bypasses a size check and triggers a heap-based buffer overflow). Such file, when opened, would cause an application linked against libfreetype to crash, or, possibly execute arbitrary code.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?30656 Public reproducer: [2] http://alt.swiecki.net/j/f/sigsegv29.ttf Upstream changeset: [3] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=c06da1ad34663da7b6fc39b030dc3ae185b96557
Other sources
Array index error in the t42parsesfnts function in type42/t42parse.c in FreeType before 2.4.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via negative size values for certain strings in FontType42 font files, leading to a heap-based buffer overflow.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2806?
CVE-2010-2806 has a high severity due to the potential for heap-based buffer overflow attacks.
How do I fix CVE-2010-2806?
To fix CVE-2010-2806, update the FreeType library to version 2.4.2 or later.
What types of systems are affected by CVE-2010-2806?
CVE-2010-2806 affects software using FreeType versions prior to 2.4.2 and various versions of Ubuntu and macOS.
Can an attacker exploit CVE-2010-2806 remotely?
Yes, an attacker can exploit CVE-2010-2806 remotely by supplying a specially-crafted font file.
What impact does CVE-2010-2806 have on affected systems?
CVE-2010-2806 can lead to arbitrary code execution and potentially compromise affected systems.