CVE-2014-9747: High severity FreeType FreeType vulnerability
Published Jun 7, 2016
·Updated
The t42parseencoding function in type42/t42parse.c in FreeType before 2.5.4 does not properly update the current position for immediates-only mode, which allows remote attackers to cause a denial of service (infinite loop) via a Type42 font.
Affected Software
3 affected components
FreeType FreeType<=2.5.3
Debian Debian Linux=7.0
Debian Debian Linux=8.0
Event History
Jun 7, 2016
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9747?
CVE-2014-9747 has been classified as a denial of service vulnerability.
2
How do I fix CVE-2014-9747?
To mitigate CVE-2014-9747, upgrade FreeType to version 2.5.4 or later.
3
Which versions of FreeType are affected by CVE-2014-9747?
FreeType versions before 2.5.4 are vulnerable to CVE-2014-9747.
4
Is CVE-2014-9747 exploitable remotely?
Yes, CVE-2014-9747 can be exploited by remote attackers by using malicious Type42 fonts.
5
On which operating systems does CVE-2014-9747 affect FreeType?
CVE-2014-9747 affects FreeType on Debian 7.0 and 8.0.