Common Vulnerabilities and Exposures assigned CVE-2014-9661 to the following issue:
type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can
be incomplete without triggering an error, which allows remote attackers to
cause a denial of service (use-after-free) or possibly have unspecified other
impact via a crafted Type42 font.
Created freetype tracking bugs for this issue:
Affects: fedora-all [bug 1191099]
freetype-2.5.3-15.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
freetype-2.5.0-9.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
Upstream bug is:
Issue was fixed upstream in 2.5.4.
This is not really a use-after-free issue. The problem rather here is that ttf_data and ttf_size get out of sync. t42_parse_sfnts() can be called multiple times. On the first call, ttf_data is allocated and ttf_size properly set to its size. On a subsequent call, tff_data re-allocated to be shorter, but ttf_size is not updated to match new ttf_data size. This leads to buffer over-read later. In that processing, valid pointer is used, in combination incorrect value indicating buffer size.
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Via RHSA-2015:0696 https://rhn.redhat.com/errata/RHSA-2015-0696.html