FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via an invalid "number of axes" field in a Printer Font…

Description

FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via an invalid "number of axes" field in a Printer Font Binary (PFB) file, which triggers a free of arbitrary memory locations, leading to memory corruption.

Scores

EPSS (exploitation in 30 days)

3.6% · top 11% of all CVEs (3 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• n/a
• CWE-189 (opens in a new tab)

Affected products

• n/a

  • affected n/a

References (56)

• 20080814 rPSA-2008-0255-1 freetype (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• GLSA-201209-25 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• 29641 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• http://www.vmware.com/security/advisories/VMSA-2008-0014.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• FEDORA-2008-5430 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• oval:org.mitre.oval:def:9767 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• 33937 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2008-1876 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 30721 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• MDVSA-2008:121 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• 1020239 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• ADV-2008-2525 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 31712 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 31709 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://sourceforge.net/project/shownotes.php?group_id=3157&release_id=605780 (opens in a new tab)x_refsource_MISCx_transferred
• http://www.vmware.com/support/server/doc/releasenotes_server.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• 30740 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://support.apple.com/kb/HT3438 (opens in a new tab)x_refsource_CONFIRMx_transferred
• GLSA-200806-10 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• 30766 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 31479 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• APPLE-SA-2009-02-12 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• ADV-2008-2423 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• http://www.vmware.com/support/player2/doc/releasenotes_player2.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• 30967 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 239006 (opens in a new tab)vendor-advisoryx_refsource_SUNALERTx_transferred
• https://issues.rpath.com/browse/RPL-2608 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 30821 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://support.apple.com/kb/HT3026 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://support.apple.com/kb/HT3129 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.vmware.com/support/player/doc/releasenotes_player.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• FEDORA-2008-5425 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• 31856 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 20080830 VMSA-2008-0014 Updates to VMware Workstation, VMware Player, VMware ACE, VMware Server, VMware ESX address information disclosure, privilege escalation and other security issues. (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 31711 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• RHSA-2008:0556 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• SUSE-SR:2008:014 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0255 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 20080610 Multiple Vendor FreeType2 PFB Memory Corruption Vulnerability (opens in a new tab)third-party-advisoryx_refsource_IDEFENSEx_transferred
• APPLE-SA-2008-09-12 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• 20080830 VMSA-2008-0014 Updates to VMware Workstation, VMware Player, VMware ACE, VMware Server, VMware ESX address information disclosure, privilege escalation and other security issues. (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• ADV-2008-1794 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 31823 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2008-2558 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 30600 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://support.avaya.com/elmodocs2/security/ASA-2008-318.htm (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• 31900 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 30819 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 31707 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• APPLE-SA-2008-09-09 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• USN-643-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• RHSA-2008:0558 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• 31577 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2008-2466 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Record last updated 7 Aug 2024, 08:32 UTC.