Common Vulnerabilities and Exposures assigned CVE-2014-9668 to the following issue: The woff_open_font function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting length values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Web Open Font Format (WOFF) file. http://code.google.com/p/google-security-research/issues/detail?id=164 http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=f46add13895337ece929b18bb8f036431b3fb538
Created freetype tracking bugs for this issue: Affects: fedora-all [bug 1191099]
freetype-2.5.3-15.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
freetype-2.5.0-9.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
Upstream bug is: https://savannah.nongnu.org/bugs/?43589 Issue was fixed upstream in 2.5.4. Affected code does not exist in the freetype packages shipped in Red Hat Enterprise Linux 7 and earlier. It was added as part of WOFF format support, introduced upstream in version 2.5.1 via the following commit: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=d689d1cf Statement: Not vulnerable. This issue did not affect the versions of freetype as shipped with Red Hat Enterprise Linux 5, 6 and 7.