CVE-2016-10244: High severity Google Android vulnerability
The parsecharstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10244?
CVE-2016-10244 is classified with a medium severity score due to its potential for causing denial of service through heap-based buffer over-read.
How do I fix CVE-2016-10244?
To mitigate CVE-2016-10244, upgrade FreeType to version 2.7.1 or later, or apply relevant patches that address this vulnerability.
What causes the vulnerability CVE-2016-10244?
CVE-2016-10244 occurs due to the parse_charstrings function failing to verify that a font file contains a glyph name, leading to buffer over-read issues.
Which products are affected by CVE-2016-10244?
CVE-2016-10244 affects FreeType versions prior to 2.7.1, and may also impact certain versions of Android and Debian Linux.
Can CVE-2016-10244 lead to system exploitation?
While CVE-2016-10244 primarily poses a risk of denial of service, it could potentially allow for further exploitation depending on the attack vector.