CVE-2015-9382: Medium severity freetype vulnerability
FreeType before 2.6.1 has a buffer over-read in skipcomment in psaux/psobjs.c because psparserskipPStoken is mishandled in an FTNewMemoryFace operation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2015-9382?
CVE-2015-9382 is a vulnerability in FreeType before version 2.6.1 that allows for a buffer over-read in skip_comment in psaux/psobjs.c.
How severe is CVE-2015-9382?
CVE-2015-9382 has a severity rating of 6.5 (medium).
Which software versions are affected by CVE-2015-9382?
The affected software versions include FreeType 2.5.2-1ubuntu2.8+ (Ubuntu Trusty), FreeType 2.6.1-0.1 (Ubuntu Upstream), FreeType 2.9.1-3+deb10u3, 2.9.1-3+deb10u2, 2.10.4+dfsg-1+deb11u1, 2.12.1+dfsg-5, 2.13.2+dfsg-1 (Debian), and FreeType up to version 2.6.1 (Red Hat).
How can I fix CVE-2015-9382?
To fix CVE-2015-9382, you should update FreeType to version 2.6.1 or later.
Where can I find more information about CVE-2015-9382?
You can find more information about CVE-2015-9382 at the following references: [Link 1](http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/src/psaux/psobjs.c?id=db5a4a9ae7b0048f033361744421da8569642f73), [Link 2](https://access.redhat.com/errata/RHSA-2019:4254), [Link 3](https://lists.debian.org/debian-lts-announce/2019/09/msg00002.html).