Common Vulnerabilities and Exposures assigned CVE-2014-9666 to the following issue: The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted embedded bitmap. http://code.google.com/p/google-security-research/issues/detail?id=167 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=257c270bd25e15890190a28a1456e7623bba4439
Created freetype tracking bugs for this issue: Affects: fedora-all [bug 1191099]
freetype-2.5.3-15.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
freetype-2.5.0-9.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
Upstream bug is: https://savannah.nongnu.org/bugs/?43591 Issue was fixed upstream in 2.5.4. The issue is an integer overflow flaw in a check protecting against out-of-bounds reads. The check was originally introduced in: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=88ab638e Affected code is not build and used in the freetype packages in Red Hat Enterprise Linux. In versions prior to 2.5, the code was only used when FT_CONFIG_OPTION_OLD_INTERNALS macro was not defined. Upstream default was to define the macro and it only became undefined by default in upstream version 2.4.12: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=e4ecce3b The freetype packages in Red Hat Enterprise Linux 7 are based on upstream version 2.4.11 or older and do not override this upstream default. Statement: This issue did not affect the versions of freetype as shipped with Red Hat Enterprise Linux 5, 6, and 7.