Common Vulnerabilities and Exposures assigned CVE-2014-9668 to the following issue:
The woff_open_font function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds
with offset+length calculations without restricting length values, which allows
remote attackers to cause a denial of service (integer overflow and heap-based
buffer overflow) or possibly have unspecified other impact via a crafted Web
Open Font Format (WOFF) file.
Created freetype tracking bugs for this issue:
Affects: fedora-all [bug 1191099]
freetype-2.5.3-15.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
freetype-2.5.0-9.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
Upstream bug is:
Issue was fixed upstream in 2.5.4.
Affected code does not exist in the freetype packages shipped in Red Hat Enterprise Linux 7 and earlier. It was added as part of WOFF format support, introduced upstream in version 2.5.1 via the following commit:
Not vulnerable. This issue did not affect the versions of freetype as shipped with Red Hat Enterprise Linux 5, 6 and 7.