CVE-2012-1138: Buffer Overflow
An out-of heap-based buffer read flaw was found in the way TrueType bytecode / opcode interpreter of FreeType font rendering engine executed the 'Move Indirect Relative Point' (MIRP) instruction. A remote attacker could provide a specially-crafted font file, which once opened in an application linked against FreeType would lead to that application crash.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35646
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=a33c013fe2dc6e65de2879682201d9c155292349
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
Other sources
FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via vectors involving the MIRP instruction in a TrueType font.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1138?
CVE-2012-1138 is classified as a moderate severity vulnerability due to the potential for information disclosure and Denial of Service attacks.
How do I fix CVE-2012-1138?
To fix CVE-2012-1138, it is recommended to update FreeType to version 2.4.9 or later.
Which versions of FreeType are affected by CVE-2012-1138?
CVE-2012-1138 affects FreeType versions up to and including 2.4.8 as well as specific older versions.
Can CVE-2012-1138 be exploited remotely?
Yes, CVE-2012-1138 can be exploited remotely by attackers through specially crafted font files.
What kinds of applications are affected by CVE-2012-1138?
Applications that utilize the FreeType font rendering engine to process fonts are affected by CVE-2012-1138.