CVE-2014-9746: Input Validation
The (1) t1parsefontmatrix function in type1/t1load.c, (2) cidparsefontmatrix function in cid/cidload.c, (3) t42parsefontmatrix function in type42/t42parse.c, and (4) psparserloadfield function in psaux/psobjs.c in FreeType before 2.5.4 do not check return values, which allows remote attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted font.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9746?
CVE-2014-9746 is classified as a moderate severity vulnerability due to insufficient checks in FreeType's font parsing functions.
How do I fix CVE-2014-9746?
To fix CVE-2014-9746, upgrade FreeType to version 2.5.4 or later, where the vulnerability has been addressed.
What software is affected by CVE-2014-9746?
CVE-2014-9746 affects FreeType versions up to and including 2.5.3 and Debian Linux versions 7.0 and 8.0.
What types of attacks can be launched due to CVE-2014-9746?
CVE-2014-9746 allows attackers to exploit font parsing vulnerabilities to execute arbitrary code or cause application crashes.
Who is primarily impacted by CVE-2014-9746?
Users and applications that rely on vulnerable versions of FreeType for font rendering are primarily impacted by CVE-2014-9746.