CVE-2016-10328: Buffer Overflow
First published: Fri Apr 14 2017(Updated: )
FreeType 2 before 2016-12-16 has an out-of-bounds write caused by a heap-based buffer overflow related to the cff_parser_run function in cff/cffparse.c.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Freetype Freetype | <=2.7 | |
| Oracle Outside In Technology | =8.5.4 | |
| <=6.0.2 | ||
| <=6.0.6.1 | ||
| <=6.0.6 | ||
| <=7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=beecf80a6deecbaf5d264d4f864451bde4fe98b8
- http://savannah.nongnu.org/bugs/?func=detailitem&item_id=49858
- http://www.securityfocus.com/bid/97677
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=289
- https://security.gentoo.org/glsa/201706-14
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/126666
- https://www.ibm.com/support/pages/node/6235162 (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this FreeType 2 vulnerability?
The vulnerability ID for this FreeType 2 vulnerability is CVE-2016-10328.
What is the severity of CVE-2016-10328?
The severity of CVE-2016-10328 is critical with a severity value of 9.8.
What software is affected by CVE-2016-10328?
The software affected by CVE-2016-10328 includes FreeType, Oracle Outside In Technology, IBM RDNG, and IBM DOORS Next.
How is CVE-2016-10328 exploited?
CVE-2016-10328 is exploited by sending a specially crafted request to trigger a heap-based buffer overflow.
Are there any references for more information on CVE-2016-10328?
Yes, for more information on CVE-2016-10328, you can refer to the following links: [link1], [link2], [link3].
- collector/nvd-index
- agent/references
- agent/type
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/weakness
- agent/remedy
- agent/severity
- agent/author
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- agent/event
- agent/trending
- vendor/freetype
- canonical/freetype freetype
- version/freetype freetype/2.7
- vendor/oracle
- canonical/oracle outside in technology
- version/oracle outside in technology/8.5.4
- vendor/ibm
- canonical/ibm rdng
- version/ibm rdng/6.0.2
- version/ibm rdng/6.0.6.1
- version/ibm rdng/6.0.6
- canonical/ibm doors next
- version/ibm doors next/7.0