CVE-2010-3855

EUVD-2010-3834
Buffer overflow in the ft_var_readpackedpoints function in truetype/ttgxvar.c in FreeType 2.4.3 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TrueType GX font.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
Affected Products (NVD)
VendorProductVersion
freetypefreetype
𝑥
≤ 2.4.3
freetypefreetype
1.3.1
freetypefreetype
2.0.6
freetypefreetype
2.0.9
freetypefreetype
2.1
freetypefreetype
2.1.3
freetypefreetype
2.1.4
freetypefreetype
2.1.5
freetypefreetype
2.1.6
freetypefreetype
2.1.7
freetypefreetype
2.1.8
freetypefreetype
2.1.9
freetypefreetype
2.1.10
freetypefreetype
2.2.0
freetypefreetype
2.2.1
freetypefreetype
2.2.10
freetypefreetype
2.3.0
freetypefreetype
2.3.1
freetypefreetype
2.3.2
freetypefreetype
2.3.3
freetypefreetype
2.3.4
freetypefreetype
2.3.5
freetypefreetype
2.3.6
freetypefreetype
2.3.7
freetypefreetype
2.3.8
freetypefreetype
2.3.9
freetypefreetype
2.3.10
freetypefreetype
2.3.11
freetypefreetype
2.3.12
freetypefreetype
2.4.0
freetypefreetype
2.4.1
freetypefreetype
2.4.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
freetype
bookworm
2.12.1+dfsg-5+deb12u3
fixed
bullseye
2.10.4+dfsg-1+deb11u1
fixed
sid
2.13.3+dfsg-1
fixed
trixie
2.13.3+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
freetype
dapper
Fixed 2.1.10-1ubuntu2.10
released
hardy
Fixed 2.3.5-1ubuntu4.8.04.6
released
jaunty
ignored
karmic
Fixed 2.3.9-5ubuntu0.4
released
lucid
Fixed 2.3.11-1ubuntu2.4
released
maverick
Fixed 2.4.2-2ubuntu0.1
released
References