VIR Vulnerability Intelligence Relay

CVE-2014-9665

high
Published 2015-02-08 · Modified 2026-05-06
CVSS v3
—
CVSS v2
7.5
VIR risk
7.5

Description

The Load_SBit_Png function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact by embedding a PNG file in a .ttf font file.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2014-9665

OS impact
OSVersionStatusFixed in
debian debianbookwormfixed2.5.2-3
debian debianbullseyefixed2.5.2-3
debian debianforkyfixed2.5.2-3
debian debiansidfixed2.5.2-3
debian debiantrixiefixed2.5.2-3
ubuntu ubuntu10.04affected
ubuntu ubuntu12.04affected
ubuntu ubuntu14.04affected
ubuntu ubuntu14.10affected
ubuntu ubuntu15.10affected
suse suse13.1affected
suse suse13.2affected
fedora fedora20affected
fedora fedora21affected

Application impact
VendorProductVersionsFixed
freetypefreetype{"endIncluding":"2.5.3"}

References

CWEs

CWE-119

Verify integrity in audit chain (admin only). AS-IS.