medium
6.8
CWE
189 190
Advisory Published
Updated

CVE-2014-9666: Integer Overflow

First published: Sun Feb 08 2015(Updated: )

The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted embedded bitmap.

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
SUSE Linux=13.1
SUSE Linux=13.2
Oracle Solaris and Zettabyte File System (ZFS)=10.0
Oracle Solaris and Zettabyte File System (ZFS)=11.2
Ubuntu=10.04
Ubuntu=12.04
Ubuntu=14.04
Ubuntu=14.10
Ubuntu=15.04
Debian=7.0
Red Hat Enterprise Linux Desktop=6.0
Red Hat Enterprise Linux Desktop=7.0
Red Hat Enterprise Linux HPC Node=6
Red Hat Enterprise Linux HPC Node=7.0
Red Hat Enterprise Linux HPC Node=7.1
Red Hat Enterprise Linux Server=6.0
Red Hat Enterprise Linux Server=7.0
Red Hat Enterprise Linux Server=6.6.z
Red Hat Enterprise Linux Server=7.1
Red Hat Enterprise Linux Workstation=6.0
Red Hat Enterprise Linux Workstation=7.0
Fedora=20
Fedora=21
FreeType<=2.5.3

Remedy

http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=257c270bd25e15890190a28a1456e7623bba4439

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2014-9666?

    CVE-2014-9666 has been classified as a denial of service vulnerability due to potential integer overflow and out-of-bounds read.

  • How do I fix CVE-2014-9666?

    To fix CVE-2014-9666, upgrade FreeType to version 2.5.4 or later to mitigate the vulnerability.

  • What software is affected by CVE-2014-9666?

    CVE-2014-9666 affects FreeType versions prior to 2.5.4 and various distributions including Ubuntu, Red Hat, Oracle Solaris, and Debian.

  • What impact can CVE-2014-9666 have?

    CVE-2014-9666 can lead to a denial of service caused by an integer overflow and out-of-bounds read.

  • Is CVE-2014-9666 easy to exploit?

    CVE-2014-9666 could be exploited by remote attackers, thus posing a significant risk to systems using vulnerable versions of FreeType.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203