CVE-2014-9745
The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to...
The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a "broken number-with-base" in a Postscript stream, as demonstrated by 8#garbage.
Exploit likelihood
What each source reports
NVD Score used
The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a "broken number-with-base" in a Postscript stream, as demonstrated by 8#garbage.
- Record
CVE-2014-9745- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a "broken number-with-base" in a Postscript stream, as demonstrated by 8#garbage.
- Record
CVE-2014-9745- Updated
- 2026-11-02
EUVDEUVD-2014-9551 No score
The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a "broken number-with-base" in a Postscript stream, as demonstrated by 8#garbage.
- Record
EUVD-2014-9551- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-62g3-xfgr-2wg5 No score
The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to...
The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a "broken number-with-base" in a Postscript stream, as demonstrated by 8#garbage.
- Record
GHSA-62g3-xfgr-2wg5- Updated
- 2026-11-02
OSV No score
The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a "broken number-with-base" in a Postscript stream, as demonstrated by 8#garbage.
- Record
CVE-2014-9745- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-9745 No score
The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a "broken number-with-base" in a Postscript stream, as demonstrated by 8#garbage.
- Record
DEBIAN-CVE-2014-9745- Updated
- 2026-11-02
OSVSUSE-SU-2016:1149-1 No score
Security update for freetype2
This update of the freetype2 library fixes two security issues:
- An infinite loop in parse_encoding in t1load.c (CVE-2014-9745, bsc#945849)
- Use of uninitialized memory in ps_parser_load_field, t42_parse_font_matrix and t1_parse_font_matrix (CVE-2014-9747, bsc#947966)
- Record
SUSE-SU-2016:1149-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-9745 No score
The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a "broken number-with-base" in a Postscript stream, as demonstrated by 8#garbage.
- Record
UBUNTU-CVE-2014-9745- Updated
- 2026-11-02
OSVUSN-2739-1 No score
freetype vulnerabilities
It was discovered that FreeType did not correctly handle certain malformed font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash or hang, resulting in a denial of service, or possibly expose uninitialized memory.
- Record
USN-2739-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
freetypeDebian:12 |
before 2.6-1 | 2.6-1 |
freetypeDebian:13 |
before 2.6-1 | 2.6-1 |
freetypeDebian:14 |
before 2.6-1 | 2.6-1 |
freetypeDebian:6.0 |
before 2.4.2-2.1+squeeze6, plus listed versions 2.4.2-2.12.4.2-2.1+squeeze12.4.2-2.1+squeeze22.4.2-2.1+squeeze32.4.2-2.1+squeeze42.4.2-2.1+squeeze5 |
2.4.2-2.1+squeeze6 |
freetypeDebian:7 |
before 2.4.9-1.1+deb7u2, plus listed versions 2.4.9-1.12.4.9-1.1+deb7u1 |
2.4.9-1.1+deb7u2 |
freetypeDebian:8 |
before 2.5.2-3+deb8u1, plus listed versions 2.5.2-32.5.2-3+deb8u1~kbsd8u1 |
2.5.2-3+deb8u1 |
freetype2SUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 2.3.7-25.41.4 | 2.3.7-25.41.4 |
freetype2SUSE:Linux Enterprise Server 11 SP4 |
before 2.3.7-25.41.4 | 2.3.7-25.41.4 |
ft2demosSUSE:Linux Enterprise Server 11 SP4 |
before 2.3.7-25.41.4 | 2.3.7-25.41.4 |
freetype2SUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 2.3.7-25.41.4 | 2.3.7-25.41.4 |
ft2demosSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 2.3.7-25.41.4 | 2.3.7-25.41.4 |
freetypeUbuntu:14.04:LTS |
before 2.5.2-1ubuntu2.5, plus listed versions 2.4.12-0ubuntu12.5.0.1-0ubuntu22.5.1-1ubuntu12.5.1-1ubuntu22.5.1-2ubuntu1 Show 6 moreShow less2.5.2-1ubuntu12.5.2-1ubuntu22.5.2-1ubuntu2.12.5.2-1ubuntu2.22.5.2-1ubuntu2.32.5.2-1ubuntu2.4 |
2.5.2-1ubuntu2.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9745 is a medium vulnerability (CVSS 5.0) in Freetype, published September 10, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.73%, the 89th percentile. Fixed in freetype 2.6-1.
References
ubuntu.com/usn/USN-2739-1
lists.opensuse.org/opensuse-updates/2015-10/msg00017.html
git.savannah.gnu.org/cgit/freetype/freetype2.git/commit?id=df14e6c0b9592cbb24d5381dfc6106b14f915e75
securityfocus.com/bid/76727
savannah.nongnu.org/bugs/index.php?41590
code.google.com/p/chromium/issues/detail?id=459050
Show 15 moreShow less
debian.org/security/2015/dsa-3370
bugs.launchpad.net/ubuntu/+source/freetype/+bug/1492124
securitytracker.com/id/1033536
nvd.nist.gov/vuln/detail/CVE-2014-9745
github.com/advisories/GHSA-62g3-xfgr-2wg5
security-tracker.debian.org/tracker/CVE-2014-9745
suse.com/support/update/announcement/2016/suse-su-20161149-1
bugzilla.suse.com/945849
ubuntu.com/security/CVE-2014-9745
cve.org/CVERecord?id=CVE-2014-9745
launchpad.net/bugs/1449225