CVE-2012-1133
FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows...
CVE-2012-1133 is a high vulnerability (CVSS 9.3) in Freetype, published March 7, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.75%, the 92nd percentile. Fixed in freetype 2.4.9-1.
- Severity
- 9.3 HighCVSS 2.0, NVD
- Exploit chance
- 4.75%EPSS, 92nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.4.9-1freetype +4 more
Description
FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via crafted glyph or bitmap data in a BDF font.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
freetypeDebian:12 | before 2.4.9-1 | 2.4.9-1 |
freetypeDebian:13 | before 2.4.9-1 | 2.4.9-1 |
freetypeDebian:14 | before 2.4.9-1 | 2.4.9-1 |
freetypeDebian:6.0 From an advisory covering 5 CVEs | before 2.4.2-2.1+squeeze4, plus listed versions 2.4.2-2.12.4.2-2.1+squeeze12.4.2-2.1+squeeze22.4.2-2.1+squeeze3 | 2.4.2-2.1+squeeze4 |
freetype2openSUSE:Tumbleweed From an advisory covering 55 CVEs | before 2.7-1.1 | 2.7-1.1 |
What each source reports
NVD Score used
FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via crafted glyph or bitmap data in a BDF font.
- Record
CVE-2012-1133- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via crafted glyph or bitmap data in a BDF font.
- Record
CVE-2012-1133- Updated
- 2026-11-02
EUVDEUVD-2012-1167No score
FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via crafted glyph or bitmap data in a BDF font.
- Record
EUVD-2012-1167- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9wgx-qrcm-5pv8No score
FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows...
FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via crafted glyph or bitmap data in a BDF font.
- Record
GHSA-9wgx-qrcm-5pv8- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVNo score
FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via crafted glyph or bitmap data in a BDF font.
- Record
CVE-2012-1133- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-1133No score
FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via crafted glyph or bitmap data in a BDF font.
- Record
DEBIAN-CVE-2012-1133- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10438-1No score
freetype2-devel-2.7-1.1 on GA media
These are all security issues fixed in the freetype2-devel-2.7-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10438-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/48797
mandriva.com/security/advisories?name=MDVSA-2012:057
lists.apple.com/archives/security-announce/2012/Sep/msg00003.html
Show 75 moreShow less
support.apple.com/kb/HT5503
securityfocus.com/bid/52318
ubuntu.com/usn/USN-1403-1
bugzilla.mozilla.org/show_bug.cgi?id=733512
openwall.com/lists/oss-security/2012/03/06/16
lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html
mozilla.org/security/announce/2012/mfsa2012-21.html
bugzilla.redhat.com/show_bug.cgi?id=800591
securitytracker.com/id?1026765
security.gentoo.org/glsa/glsa-201204-04.xml
debian.org/security/2012/dsa-2428
nvd.nist.gov/vuln/detail/CVE-2012-1133
github.com/advisories/GHSA-9wgx-qrcm-5pv8
security-tracker.debian.org/tracker/CVE-2012-1133
suse.com/security/cve/CVE-2009-0946