CVE-2014-2240: Buffer Overflow
Published Mar 12, 2014
·Updated
Stack-based buffer overflow in the cf2hintmapbuild function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of stem hints in a font file.
Affected Software
52 affected components
FreeType<=2.5.2
FreeType=1.3.1
FreeType=2.0.0
FreeType=2.0.1
FreeType=2.0.2
FreeType=2.0.3
FreeType=2.0.4
FreeType=2.0.5
FreeType=2.0.6
FreeType=2.0.7
FreeType=2.0.8
FreeType=2.0.9
FreeType=2.1
FreeType=2.1.3
FreeType=2.1.4
FreeType=2.1.5
FreeType=2.1.6
FreeType=2.1.7
FreeType=2.1.8
FreeType=2.1.8-rc1
FreeType=2.1.9
FreeType=2.1.10
FreeType=2.2.0
FreeType=2.2.1
FreeType=2.3.0
FreeType=2.3.1
FreeType=2.3.2
FreeType=2.3.3
FreeType=2.3.4
FreeType=2.3.5
FreeType=2.3.6
FreeType=2.3.7
FreeType=2.3.8
FreeType=2.3.9
FreeType=2.3.10
FreeType=2.3.11
FreeType=2.3.12
FreeType=2.4.0
FreeType=2.4.1
FreeType=2.4.2
FreeType=2.4.3
FreeType=2.4.4
FreeType=2.4.5
FreeType=2.4.6
FreeType=2.4.7
FreeType=2.4.8
FreeType=2.4.9
FreeType=2.4.10
FreeType=2.4.11
FreeType=2.4.12
FreeType=2.5
FreeType=2.5.1
Remediation
Patch Available
Event History
Mar 12, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:55 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-2240?
CVE-2014-2240 has a severity rating of medium due to its potential to cause denial of service and arbitrary code execution.
2
How do I fix CVE-2014-2240?
To fix CVE-2014-2240, upgrade FreeType to version 2.5.3 or later.
3
What systems are affected by CVE-2014-2240?
CVE-2014-2240 affects FreeType versions prior to 2.5.3 and specific versions including 1.3.1, 2.0.0 through 2.5.1.
4
What attack vector is associated with CVE-2014-2240?
CVE-2014-2240 can be exploited by remote attackers through specially crafted font files.
5
What kind of vulnerability is CVE-2014-2240?
CVE-2014-2240 is a stack-based buffer overflow vulnerability.