vulnwire
7.5high

CVE-2008-1807

FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via an invalid "number of axes" field in a Printer Font…

Published 18 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.6%
percentile 89%
Public exploits
0
none known

FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via an invalid "number of axes" field in a Printer Font Binary (PFB) file, which triggers a free of arbitrary memory locations, leading to memory corruption.

Exploit prediction (EPSS)

3.58% probability of exploitation in the next 30 days, higher than 89% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

References

  • securityfocus.com /archive/1/495497/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • security.gentoo.org /glsa/glsa-201209-25.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • securityfocus.com /bid/29641 · vdb-entry, x_refsource_BID, x_transferred
  • vmware.com /security/advisories/VMSA-2008-0014.html · x_refsource_CONFIRM, x_transferred
  • redhat.com /archives/fedora-package-announce/2008-June/msg00721.html · vendor-advisory, x_refsource_FEDORA, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9767 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • secunia.com /advisories/33937 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vupen.com /english/advisories/2008/1876/references · vdb-entry, x_refsource_VUPEN, x_transferred
  • secunia.com /advisories/30721 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • mandriva.com /security/advisories?name=MDVSA-2008:121 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
  • securitytracker.com /id?1020239 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • vupen.com /english/advisories/2008/2525 · vdb-entry, x_refsource_VUPEN, x_transferred
  • secunia.com /advisories/31712 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/31709 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • sourceforge.net /project/shownotes.php?group_id=3157&release_id=605780 · x_refsource_MISC, x_transferred
  • vmware.com /support/server/doc/releasenotes_server.html · x_refsource_CONFIRM, x_transferred
  • secunia.com /advisories/30740 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • support.apple.com /kb/HT3438 · x_refsource_CONFIRM, x_transferred
  • security.gentoo.org /glsa/glsa-200806-10.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • secunia.com /advisories/30766 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/31479 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • lists.apple.com /archives/security-announce/2009/Feb/msg00000.html · vendor-advisory, x_refsource_APPLE, x_transferred
  • vupen.com /english/advisories/2008/2423 · vdb-entry, x_refsource_VUPEN, x_transferred
  • vmware.com /support/player2/doc/releasenotes_player2.html · x_refsource_CONFIRM, x_transferred
  • secunia.com /advisories/30967 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • sunsolve.sun.com /search/document.do?assetkey=1-26-239006-1 · vendor-advisory, x_refsource_SUNALERT, x_transferred
  • issues.rpath.com /browse/RPL-2608 · x_refsource_CONFIRM, x_transferred
  • secunia.com /advisories/30821 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • support.apple.com /kb/HT3026 · x_refsource_CONFIRM, x_transferred
  • support.apple.com /kb/HT3129 · x_refsource_CONFIRM, x_transferred
  • vmware.com /support/player/doc/releasenotes_player.html · x_refsource_CONFIRM, x_transferred
  • redhat.com /archives/fedora-package-announce/2008-June/msg00717.html · vendor-advisory, x_refsource_FEDORA, x_transferred
  • vmware.com /support/ws6/doc/releasenotes_ws6.html · x_refsource_CONFIRM, x_transferred
  • secunia.com /advisories/31856 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /archive/1/495869/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • secunia.com /advisories/31711 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • redhat.com /support/errata/RHSA-2008-0556.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2008-07/msg00001.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • wiki.rpath.com /wiki/Advisories:rPSA-2008-0255 · x_refsource_CONFIRM, x_transferred
  • labs.idefense.com /intelligence/vulnerabilities/display.php?id=716 · third-party-advisory, x_refsource_IDEFENSE, x_transferred
  • lists.apple.com /archives/security-announce//2008/Sep/msg00003.html
  • lists.apple.com /archives/security-announce//2008/Sep/msg00004.html
  • lists.grok.org.uk /pipermail/full-disclosure/2008-August/064118.html
  • secunia.com /advisories/30600 · Vendor Advisory
  • secunia.com /advisories/30819
  • secunia.com /advisories/31577
  • secunia.com /advisories/31707
  • secunia.com /advisories/31823
  • secunia.com /advisories/31900
  • support.avaya.com /elmodocs2/security/ASA-2008-318.htm
  • redhat.com /support/errata/RHSA-2008-0558.html
  • ubuntu.com /usn/usn-643-1

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.