PublicDateAtUSN: 2014-03-12
Candidate: CVE-2014-2240
PublicDate: 2014-03-12 14:55:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2240
 http://sourceforge.net/projects/freetype/files/freetype2/2.5.3/
 http://www.securitytracker.com/id/1029895
 http://secunia.com/advisories/57291
 https://ubuntu.com/security/notices/USN-2148-1
Description:
 Stack-based buffer overflow in the cf2_hintmap_build function in
 cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a
 denial of service (crash) and possibly execute arbitrary code via a large
 number of stem hints in a font file.
Ubuntu-Description:
Notes:
 seth-arnold> see also CVE-2014-9659
Bugs:
 https://savannah.nongnu.org/bugs/?41697
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=741299
Priority: medium
Discovered-by: Mateusz Jurczyk
Assigned-to: mdeslaur
CVSS: 

Patches_freetype:
 upstream: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0eae6eb0645264c98812f0095e0f5df4541830e6
upstream_freetype: released (2.5.3)
lucid_freetype: not-affected (code not present)
precise_freetype: not-affected (code not present)
quantal_freetype: not-affected (code not present)
saucy_freetype: released (2.4.12-0ubuntu1.1)
devel_freetype: released (2.5.2-1ubuntu2)