Buffer overflow in the ft_var_readpackedpoints function in truetype/ttgxvar.c in FreeType 2.4.3 and earlier allows remote attackers to…

Description

Buffer overflow in the ft_var_readpackedpoints function in truetype/ttgxvar.c in FreeType 2.4.3 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TrueType GX font.

Scores

EPSS (exploitation in 30 days)

5.3% · top 7.4% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.8.

Weakness

• n/a
• CWE-119 (opens in a new tab)All about CWE-119 and its CVEs

Affected products

• n/a

  • affected n/a

References (30)

• 43138 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 42295 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=602221 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://support.avaya.com/css/P8/documents/100122733 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://support.apple.com/kb/HT4564 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://support.apple.com/kb/HT4565 (opens in a new tab)x_refsource_CONFIRMx_transferred
• MDVSA-2010:235 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• http://support.apple.com/kb/HT4803 (opens in a new tab)x_refsource_CONFIRMx_transferred
• ADV-2011-0246 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• FEDORA-2010-17755 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• APPLE-SA-2011-07-15-1 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• 44214 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• FEDORA-2010-17742 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• RHSA-2010:0889 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• APPLE-SA-2011-03-21-1 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• FEDORA-2010-17728 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• USN-1013-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• 42289 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• APPLE-SA-2011-07-15-2 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• https://savannah.nongnu.org/bugs/?31310 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://support.apple.com/kb/HT4802 (opens in a new tab)x_refsource_CONFIRMx_transferred
• MDVSA-2010:236 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• APPLE-SA-2011-03-09-1 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=59eb9f8cfe7d1df379a2318316d1f04f80fba54a (opens in a new tab)x_refsource_CONFIRMx_transferred
• 1024745 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• APPLE-SA-2011-03-09-3 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• 48951 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• DSA-2155 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• ADV-2010-3037 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• http://support.apple.com/kb/HT4581 (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2010-3855](https://trackcve.app/badge/CVE-2010-3855.svg)](https://trackcve.app/cve/CVE-2010-3855)

Record last updated 7 Aug 2024, 03:26 UTC.