CVE-2014-9670: Integer Overflow
Multiple integer signedness errors in the pcfgetencodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer overflow, NULL pointer dereference, and application crash) via a crafted PCF file that specifies negative values for the first column and first row.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9670?
CVE-2014-9670 has a severity rating that affects the stability of applications by causing denial of service due to integer signedness errors.
How do I fix CVE-2014-9670?
To fix CVE-2014-9670, update FreeType to version 2.5.4 or later.
What are the implications of CVE-2014-9670?
CVE-2014-9670 can lead to denial of service through application crashes due to crafted PCF files.
Which software versions are affected by CVE-2014-9670?
CVE-2014-9670 affects FreeType versions up to and including 2.5.3 and various Linux distributions listed in the advisory.
Can CVE-2014-9670 be exploited remotely?
Yes, CVE-2014-9670 can be exploited remotely by attackers using specially crafted PCF files.