CVE-2012-5668

FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to BDF fonts and the improper handling of an "allocation error" in the bdf_free_font function.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:N/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 86%
Affected Products (NVD)
VendorProductVersion
freetypefreetype
𝑥
≤ 2.4.10
freetypefreetype
1.3.1
freetypefreetype
2.0.0
freetypefreetype
2.0.1
freetypefreetype
2.0.2
freetypefreetype
2.0.3
freetypefreetype
2.0.4
freetypefreetype
2.0.5
freetypefreetype
2.0.6
freetypefreetype
2.0.7
freetypefreetype
2.0.8
freetypefreetype
2.0.9
freetypefreetype
2.1
freetypefreetype
2.1.3
freetypefreetype
2.1.4
freetypefreetype
2.1.5
freetypefreetype
2.1.6
freetypefreetype
2.1.7
freetypefreetype
2.1.8
freetypefreetype
2.1.8:rc1
freetypefreetype
2.1.9
freetypefreetype
2.1.10
freetypefreetype
2.2.0
freetypefreetype
2.2.1
freetypefreetype
2.3.0
freetypefreetype
2.3.1
freetypefreetype
2.3.2
freetypefreetype
2.3.3
freetypefreetype
2.3.4
freetypefreetype
2.3.5
freetypefreetype
2.3.6
freetypefreetype
2.3.7
freetypefreetype
2.3.8
freetypefreetype
2.3.9
freetypefreetype
2.3.10
freetypefreetype
2.3.11
freetypefreetype
2.3.12
freetypefreetype
2.4.0
freetypefreetype
2.4.1
freetypefreetype
2.4.2
freetypefreetype
2.4.3
freetypefreetype
2.4.4
freetypefreetype
2.4.5
freetypefreetype
2.4.6
freetypefreetype
2.4.7
freetypefreetype
2.4.8
freetypefreetype
2.4.9
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
freetype
bookworm
2.12.1+dfsg-5+deb12u3
fixed
bullseye
2.10.4+dfsg-1+deb11u1
fixed
sid
2.13.3+dfsg-1
fixed
trixie
2.13.3+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
freetype
hardy
Fixed 2.3.5-1ubuntu4.8.04.10
released
lucid
Fixed 2.3.11-1ubuntu2.7
released
oneiric
Fixed 2.4.4-2ubuntu1.3
released
precise
Fixed 2.4.8-1ubuntu2.1
released
quantal
Fixed 2.4.10-0ubuntu1.1
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
ft2demos
suse enterprise sap 12 SP5
2.6.3-7.15.1
fixed
suse enterprise server 12 SP4
2.6.3-7.15.1
fixed
suse enterprise server 12 SP5
2.6.3-7.15.1
fixed
libfreetype6
suse enterprise sap 12 SP5
2.6.3-7.15.1
fixed
suse enterprise server 12 SP4
2.6.3-7.15.1
fixed
suse enterprise server 12 SP5
2.6.3-7.15.1
fixed
libfreetype6-32bit
suse enterprise sap 12 SP5
2.6.3-7.15.1
fixed
suse enterprise server 12 SP4
2.6.3-7.15.1
fixed
suse enterprise server 12 SP5
2.6.3-7.15.1
fixed
Common Weakness Enumeration
References
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=9b6b5754b57c12b820e01305eb69b8863a161e5a
http://lists.opensuse.org/opensuse-updates/2013-01/msg00056.html
http://lists.opensuse.org/opensuse-updates/2013-01/msg00068.html
http://lists.opensuse.org/opensuse-updates/2013-01/msg00078.html
http://secunia.com/advisories/51826
http://secunia.com/advisories/51900
http://www.freetype.org/
http://www.openwall.com/lists/oss-security/2012/12/25/2
http://www.securitytracker.com/id?1027921
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.520186
http://www.ubuntu.com/usn/USN-1686-1
https://savannah.nongnu.org/bugs/?37905
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=9b6b5754b57c12b820e01305eb69b8863a161e5a
http://lists.opensuse.org/opensuse-updates/2013-01/msg00056.html
http://lists.opensuse.org/opensuse-updates/2013-01/msg00068.html
http://lists.opensuse.org/opensuse-updates/2013-01/msg00078.html
http://secunia.com/advisories/51826
http://secunia.com/advisories/51900
http://www.freetype.org/
http://www.openwall.com/lists/oss-security/2012/12/25/2
http://www.securitytracker.com/id?1027921
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.520186
http://www.ubuntu.com/usn/USN-1686-1
https://savannah.nongnu.org/bugs/?37905