NVD

Id
36284  
Name
CVE-2014-9665  
Description
The Load_SBit_Png function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact by embedding a PNG file in a .ttf font file.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-02-08  
Modified Date
2017-01-02  
Seq
2014-9665  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
185465 36284 CVE-2014-9665 http://code.google.com/p/google-security-research/issues/detail?id=168  View
185466 36284 CVE-2014-9665 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=54abd22891bd51ef8b533b24df53b3019b5cee81  View
185467 36284 CVE-2014-9665 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=b3500af717010137046ec4076d1e1c0641e33727  View
185468 36284 CVE-2014-9665 FEDORA-2015-2237  View
185469 36284 CVE-2014-9665 FEDORA-2015-2216  View
185470 36284 CVE-2014-9665 openSUSE-SU-2015:0627  View
185471 36284 CVE-2014-9665 72986  View
185472 36284 CVE-2014-9665 USN-2510-1  View
185473 36284 CVE-2014-9665 USN-2739-1  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
18990 JVNDB-2014-007865 FreeType の sfnt/pngshim.c 内の Load_SBit_Png 関数におけるサービス運用妨害 (DoS) の脆弱性 FreeType の sfnt/pngshim.c 内の Load_SBit_Png 関数は、PNG データの行およびピッチの値を制限しないため、サービス運用妨害 (整数オーバーフローおよびヒープベースのバッファオーバーフロー) 状態にされるなど、不特定の影響を受ける脆弱性が存在します。 CVE-2014-9665 76958 CVE-2014-9665 36284 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-007865.html 2014-11-15 2015-02-17 View