CVE-2014-9659

cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint mask has been computed, which allows…

published February 8, 2015

CVSS
—
EPSS
8%
Percentile
94.6
In the wild
Unconfirmed
What it is

cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint mask has been computed, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted OpenType font. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2240.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.07687 · 94.6th percentile
Published
2015-02-08T11:00Z
EPSS history
Timeline
  • 08 FEB 11:00Z
    cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint mask has been computed, which allows…
    cvelistv5