Common Vulnerabilities and Exposures assigned CVE-2014-9665 to the following issue:
The Load_SBit_Png function in sfnt/pngshim.c in FreeType before 2.5.4 does not
restrict the rows and pitch values of PNG data, which allows remote attackers to
cause a denial of service (integer overflow and heap-based buffer overflow) or
possibly have unspecified other impact by embedding a PNG file in a .ttf font
Created freetype tracking bugs for this issue:
Affects: fedora-all [bug 1191099]
freetype-2.5.3-15.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
freetype-2.5.0-9.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
Upstream bug is:
Issue was fixed upstream in 2.5.4.
Support for bitmaps embedded in SFNT fonts was introduced in upstream version 2.5. Additionally, the affected code was added in 2.5.1 via:
The freetype packages in Red Hat Enterprise Linux 7 and earlier are based on older unaffected upstream versions.
Not vulnerable. This issue did not affect the versions of freetype as shipped with Red Hat Enterprise Linux 5, 6 and 7.