CVE-2012-1143: Divide by Zero
An integer divide by zero was found in the way FreeType font rendering engine performed arithmetic computations for certain fonts. A remote attacker could provide a specially-crafted font file, which once opened in an application linked against FreeType would lead to that application crash.
Upstream bug report: [1] https://savannah.nongnu.org/bugs/?35660
Upstream patch: [2] http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=ba67957d5ead443f4b6b31805d6e780d54361ca4
Acknowledgements:
Red Hat would like to thank Mateusz Jurczyk of the Google Security Team for reporting this issue.
Other sources
FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted font.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1143?
CVE-2012-1143 is classified as a moderate severity vulnerability due to the potential for application crashes when rendering specifically crafted font files.
How do I fix CVE-2012-1143?
To fix CVE-2012-1143, update the FreeType library to version 2.4.9 or later, which addresses the integer divide by zero issue.
What applications are affected by CVE-2012-1143?
Applications linked against affected versions of the FreeType library, such as various graphic and web browsers, can be impacted by CVE-2012-1143.
Can CVE-2012-1143 be exploited remotely?
Yes, an attacker can exploit CVE-2012-1143 remotely by sending a specially crafted font file to the target application.
What does CVE-2012-1143 pertain to in FreeType?
CVE-2012-1143 pertains to an integer divide by zero vulnerability in the FreeType font rendering engine caused by faulty arithmetic computations.