The woff_open_font function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting length values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Web Open Font Format (WOFF) file.

freetype2 was updated to fix various vulnerabilities that could lead to crashes or potentially code execution when parsing fonts.

The font rendering library freetype2 has been updated to fix various security issues.

The remote host is affected by the vulnerability described in GLSA-201503-05 (FreeType: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FreeType. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker can cause Denial of Service.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2510-1 advisory.

    Mateusz Jurczyk discovered that FreeType did not correctly handle certain malformed font files. If a user     were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash or     possibly execute arbitrary code with user privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes several security issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
82461	openSUSE Security Update : freetype2 (openSUSE-2015-274)	Nessus	SuSE Local Security Checks	high
81752	SuSE 11.3 Security Update : freetype2 (SAT Patch Number 10386)	Nessus	SuSE Local Security Checks	high
81690	GLSA-201503-05 : FreeType: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
81509	Ubuntu 14.04 LTS : FreeType vulnerabilities (USN-2510-1)	Nessus	Ubuntu Local Security Checks	medium
81429	Fedora 20 : freetype-2.5.0-9.fc20 (2015-2216)	Nessus	Fedora Local Security Checks	high
81415	Fedora 21 : freetype-2.5.3-15.fc21 (2015-2237)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2014-9668

high

Tenable Plugins

high

high

high

medium

high

high