Every CVE Search/ Get API key

CVE-2010-1797

Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF...

9.3 HighPublic exploitFix available

Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF Type2 CharStrings interpreter in cff/cffgload.c in FreeType before 2.4.2, as used in Apple iOS before 4.0.2 on the iPhone and iPod touch and before 3.2.2 on the iPad, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted CFF opcodes in embedded fonts in a PDF document, as demonstrated by JailbreakMe. NOTE: some of these details are obtained from third party information.

Exploit likelihood

33.9%Down 9.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.3

Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF Type2 CharStrings interpreter in cff/cffgload.c in FreeType before 2.4.2, as used in Apple iOS before 4.0.2 on the iPhone and iPod touch and before 3.2.2 on the iPad, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted CFF opcodes in embedded fonts in a PDF document, as demonstrated by JailbreakMe. NOTE: some of these details are obtained from third party information.

Record
CVE-2010-1797
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF Type2 CharStrings interpreter in cff/cffgload.c in FreeType before 2.4.2, as used in Apple iOS before 4.0.2 on the iPhone and iPod touch and before 3.2.2 on the iPad, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted CFF opcodes in embedded fonts in a PDF document, as demonstrated by JailbreakMe. NOTE: some of these details are obtained from third party information.

Record
CVE-2010-1797
Updated
2026-11-02
EUVDEUVD-2010-1817 No score

Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF Type2 CharStrings interpreter in cff/cffgload.c in FreeType before 2.4.2, as used in Apple iOS before 4.0.2 on the iPhone and iPod touch and before 3.2.2 on the iPad, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted CFF opcodes in embedded fonts in a PDF document, as demonstrated by JailbreakMe. NOTE: some of these details are obtained from third party information.

Record
EUVD-2010-1817
Updated
2026-11-03
GitHub AdvisoriesGHSA-mph3-mc9x-x334 No score

Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF...

Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF Type2 CharStrings interpreter in cff/cffgload.c in FreeType before 2.4.2, as used in Apple iOS before 4.0.2 on the iPhone and iPod touch and before 3.2.2 on the iPad, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted CFF opcodes in embedded fonts in a PDF document, as demonstrated by JailbreakMe. NOTE: some of these details are obtained from third party information.

Record
GHSA-mph3-mc9x-x334
Weakness
CWE-119
Updated
2026-11-02
OSV No score

Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF Type2 CharStrings interpreter in cff/cffgload.c in FreeType before 2.4.2, as used in Apple iOS before 4.0.2 on the iPhone and iPod touch and before 3.2.2 on the iPad, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted CFF opcodes in embedded fonts in a PDF document, as demonstrated by JailbreakMe. NOTE: some of these details are obtained from third party information.

Record
CVE-2010-1797
Updated
2026-11-02
OSVDEBIAN-CVE-2010-1797 No score

Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF Type2 CharStrings interpreter in cff/cffgload.c in FreeType before 2.4.2, as used in Apple iOS before 4.0.2 on the iPhone and iPod touch and before 3.2.2 on the iPad, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted CFF opcodes in embedded fonts in a PDF document, as demonstrated by JailbreakMe. NOTE: some of these details are obtained from third party information.

Record
DEBIAN-CVE-2010-1797
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
freetype
Debian:12
 before 2.4.2-1
2.4.2-1
freetype
Debian:13
 before 2.4.2-1
2.4.2-1
freetype
Debian:14
 before 2.4.2-1
2.4.2-1
freetype
Debian:5.0
From an advisory covering 7 CVEs
 before 2.3.7-2+lenny3, plus listed versions
2.3.7-22.3.7-2+lenny12.3.7-2+lenny2
2.3.7-2+lenny3
freetype
Red Hat:enterprise_linux:3::as
 before 0:2.1.4-16.el3
0:2.1.4-16.el3
freetype-debuginfo
Red Hat:enterprise_linux:3::as
 before 0:2.1.4-16.el3
0:2.1.4-16.el3
freetype-devel
Red Hat:enterprise_linux:3::as
 before 0:2.1.4-16.el3
0:2.1.4-16.el3
freetype
Red Hat:enterprise_linux:3::desktop
 before 0:2.1.4-16.el3
0:2.1.4-16.el3
freetype-debuginfo
Red Hat:enterprise_linux:3::desktop
 before 0:2.1.4-16.el3
0:2.1.4-16.el3
freetype-devel
Red Hat:enterprise_linux:3::desktop
 before 0:2.1.4-16.el3
0:2.1.4-16.el3
Show 36 moreShow less
Affected packages
PackageAffectedFixed
freetype
Red Hat:enterprise_linux:3::es
 before 0:2.1.4-16.el3
0:2.1.4-16.el3
freetype-debuginfo
Red Hat:enterprise_linux:3::es
 before 0:2.1.4-16.el3
0:2.1.4-16.el3
freetype-devel
Red Hat:enterprise_linux:3::es
 before 0:2.1.4-16.el3
0:2.1.4-16.el3
freetype
Red Hat:enterprise_linux:3::ws
 before 0:2.1.4-16.el3
0:2.1.4-16.el3
freetype-debuginfo
Red Hat:enterprise_linux:3::ws
 before 0:2.1.4-16.el3
0:2.1.4-16.el3
freetype-devel
Red Hat:enterprise_linux:3::ws
 before 0:2.1.4-16.el3
0:2.1.4-16.el3
freetype
Red Hat:enterprise_linux:4::as
 before 0:2.1.9-15.el4.8
0:2.1.9-15.el4.8
freetype-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:2.1.9-15.el4.8
0:2.1.9-15.el4.8
freetype-demos
Red Hat:enterprise_linux:4::as
 before 0:2.1.9-15.el4.8
0:2.1.9-15.el4.8
freetype-devel
Red Hat:enterprise_linux:4::as
 before 0:2.1.9-15.el4.8
0:2.1.9-15.el4.8
freetype-utils
Red Hat:enterprise_linux:4::as
 before 0:2.1.9-15.el4.8
0:2.1.9-15.el4.8
freetype
Red Hat:enterprise_linux:4::desktop
 before 0:2.1.9-15.el4.8
0:2.1.9-15.el4.8
freetype-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:2.1.9-15.el4.8
0:2.1.9-15.el4.8
freetype-demos
Red Hat:enterprise_linux:4::desktop
 before 0:2.1.9-15.el4.8
0:2.1.9-15.el4.8
freetype-devel
Red Hat:enterprise_linux:4::desktop
 before 0:2.1.9-15.el4.8
0:2.1.9-15.el4.8
freetype-utils
Red Hat:enterprise_linux:4::desktop
 before 0:2.1.9-15.el4.8
0:2.1.9-15.el4.8
freetype
Red Hat:enterprise_linux:4::es
 before 0:2.1.9-15.el4.8
0:2.1.9-15.el4.8
freetype-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:2.1.9-15.el4.8
0:2.1.9-15.el4.8
freetype-demos
Red Hat:enterprise_linux:4::es
 before 0:2.1.9-15.el4.8
0:2.1.9-15.el4.8
freetype-devel
Red Hat:enterprise_linux:4::es
 before 0:2.1.9-15.el4.8
0:2.1.9-15.el4.8
freetype-utils
Red Hat:enterprise_linux:4::es
 before 0:2.1.9-15.el4.8
0:2.1.9-15.el4.8
freetype
Red Hat:enterprise_linux:4::ws
 before 0:2.1.9-15.el4.8
0:2.1.9-15.el4.8
freetype-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:2.1.9-15.el4.8
0:2.1.9-15.el4.8
freetype-demos
Red Hat:enterprise_linux:4::ws
 before 0:2.1.9-15.el4.8
0:2.1.9-15.el4.8
freetype-devel
Red Hat:enterprise_linux:4::ws
 before 0:2.1.9-15.el4.8
0:2.1.9-15.el4.8
freetype-utils
Red Hat:enterprise_linux:4::ws
 before 0:2.1.9-15.el4.8
0:2.1.9-15.el4.8
freetype
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.1-26.el5_5
0:2.2.1-26.el5_5
freetype-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.1-26.el5_5
0:2.2.1-26.el5_5
freetype-demos
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.1-26.el5_5
0:2.2.1-26.el5_5
freetype-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.2.1-26.el5_5
0:2.2.1-26.el5_5
freetype
Red Hat:enterprise_linux:5::client
 before 0:2.2.1-26.el5_5
0:2.2.1-26.el5_5
freetype-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:2.2.1-26.el5_5
0:2.2.1-26.el5_5
freetype
Red Hat:enterprise_linux:5::server
 before 0:2.2.1-26.el5_5
0:2.2.1-26.el5_5
freetype-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:2.2.1-26.el5_5
0:2.2.1-26.el5_5
freetype-demos
Red Hat:enterprise_linux:5::server
 before 0:2.2.1-26.el5_5
0:2.2.1-26.el5_5
freetype-devel
Red Hat:enterprise_linux:5::server
 before 0:2.2.1-26.el5_5
0:2.2.1-26.el5_5

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBApple iOS - '.pdf' Local Privilege Escalation 'Jailbreak'2010-08-03
Exploit-DBFoxit Reader 4.0 - '.pdf' Multiple Stack Based Buffer Overflow 'Jailbreak'2010-08-24

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2010-1797 is a high vulnerability (CVSS 9.3) in Apple Iphone Os, published August 16, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 33.9%, the 98th percentile. Fixed in freetype 2.4.2-1.

References

Show 24 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open