Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2010-2806: FreeType <2.4.2 may crash or be compromised by fonts

CVE-2010-2806 · published 16 years ago

Summary

The FreeType font‑rendering library versions before 2.4.2 can be tricked by a specially crafted FontType42 file to write outside its memory area. This can cause the application using the library to stop working or, in rare cases, allow an attacker to run their own code. Update FreeType to version 2.4.2 or later, or apply the vendor's patch, to eliminate the risk.

What to do

Update debian freetype to version 2.4.2-1.
Update freetype freetype to version 2.4.2 or later.
Update apple iphone_os to version 4.2 or later.
Update apple mac_os_x to version 10.6.5 or later.
Update apple tvos to version 4.1.0 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	freetype	< 2.4.2-1 Fix: upgrade to 2.4.2-1
Debian:13	debian	freetype	< 2.4.2-1 Fix: upgrade to 2.4.2-1
Debian:14	debian	freetype	< 2.4.2-1 Fix: upgrade to 2.4.2-1
–	freetype	freetype	< 2.4.2 `cpe:2.3:a:freetype:freetype::::::::`
–	canonical	ubuntu_linux	6.06 8.04 9.04 9.10 10.04 `cpe:2.3:o:canonical:ubuntu_linux:6.06:::::::*`
–	apple	iphone_os	< 4.2 `cpe:2.3:o:apple:iphone_os::::::::`
–	apple	mac_os_x	< 10.6.5 `cpe:2.3:o:apple:mac_os_x::::::::`
–	apple	tvos	< 4.1.0 `cpe:2.3:o:apple:tvos::::::::`

Original advisory text

Array index error in the t42_parse_sfnts function in type42/t42parse.c in FreeType before 2.4.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via negative size values for certain strings in FontType42 font files, leading to a heap-based buffer overflow.

References

https://security-tracker.debian.org/tracker/CVE-2010-2806 Vendor Advisory
http://freetype.sourceforge.net/index2.html#release-freetype-2.4.2 Release Notes Third Party Advisory
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=c06da1ad34663... Patch Third Party Advisory
http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html Mailing List Third Party Advisory
http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html Mailing List Third Party Advisory
http://marc.info/?l=oss-security&m=128111955616772&w=2 Mailing List Patch Third Party Advisory
http://secunia.com/advisories/40816 Third Party Advisory
http://secunia.com/advisories/40982 Third Party Advisory
http://secunia.com/advisories/42314 Third Party Advisory
http://secunia.com/advisories/42317 Third Party Advisory
http://sourceforge.net/projects/freetype/files/freetype2/2.4.2/NEWS/view Third Party Advisory
http://support.apple.com/kb/HT4435 Broken Link
http://support.apple.com/kb/HT4456 Third Party Advisory
http://support.apple.com/kb/HT4457 Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2010-0864.html Third Party Advisory
http://www.securityfocus.com/bid/42285 Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-972-1 Third Party Advisory
http://www.vupen.com/english/advisories/2010/2018 Third Party Advisory
http://www.vupen.com/english/advisories/2010/2106 Third Party Advisory
http://www.vupen.com/english/advisories/2010/3045 Third Party Advisory
http://www.vupen.com/english/advisories/2010/3046 Third Party Advisory
https://bugs.launchpad.net/ubuntu/maverick/+source/freetype/+bug/617019 Issue Tracking Release Notes Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=621980 Issue Tracking Patch Third Party Advisory
https://rhn.redhat.com/errata/RHSA-2010-0736.html Broken Link
https://rhn.redhat.com/errata/RHSA-2010-0737.html Broken Link
https://savannah.nongnu.org/bugs/?30656 Exploit Third Party Advisory

Severity

6.8 Medium

Exploitation

6% chance of attack within 30 days

Type

CWE-129Improper Validation of Array Index

Timeline

Published19 Aug 2010

Updated20 Oct 2026

First seen4 Sep 2026

Sources

DEBIAN-CVE-2010-2806 · OSV

CVE-2010-2806 · NVD

Track software like this

Free during beta