Common Vulnerabilities and Exposures assigned CVE-2014-9667 to the following issue:
sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations
without restricting the values, which allows remote attackers to cause a denial
of service (integer overflow and out-of-bounds read) or possibly have
unspecified other impact via a crafted SFNT table.
Created freetype tracking bugs for this issue:
Affects: fedora-all [bug 1191099]
freetype-2.5.3-15.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
freetype-2.5.0-9.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
Upstream bug is:
Issue was fixed upstream in 2.5.4.
The issue is an integer overflow flaw in a check protecting against out-of-bounds reads, making it possible to bypass check. Crashing freetype using a specially-crafted font file should be possible because of this.
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Via RHSA-2015:0696 https://rhn.redhat.com/errata/RHSA-2015-0696.html