Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2016-10328: FreeType 2: Out-of-bounds write in CFF font parser
CVE-2016-10328 · published 9 years ago
Summary
FreeType 2, a font rendering library, has a bug that could allow an attacker to execute malicious code. This affects systems that use the library to display fonts. To protect your systems, update FreeType 2 to the latest version.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| freetype | freetype |
<= 2.7 cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:* |
| oracle | outside_in_technology |
8.5.4 cpe:2.3:a:oracle:outside_in_technology:8.5.4:*:*:*:*:*:*:* |
Original advisory text
FreeType 2 before 2016-12-16 has an out-of-bounds write caused by a heap-based buffer overflow related to the cff_parser_run function in cff/cffparse.c.
FreeType 2 before 2016-12-16 has an out-of-bounds write caused by a heap-based buffer overflow related to the cff_parser_run function in cff/cffparse.c.
References
- http://savannah.nongnu.org/bugs/?func=detailitem&item_id=49858 Third Party Advisory
- http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=beecf80a6deec... Patch Third Party Advisory
- http://www.securityfocus.com/bid/97677 Third Party Advisory VDB Entry
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=289 Third Party Advisory VDB Entry
- https://security.gentoo.org/glsa/201706-14 Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-787Out-of-bounds Write
Timeline
Published14 Apr 2017
Updated23 Oct 2026
First seen15 Mar 2026
Track software like this
Free during beta