CVE-2006-1861
Multiple integer overflows in FreeType before 2.2 allow remote attackers to cause a denial of...
Multiple integer overflows in FreeType before 2.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attack vectors related to (1) bdf/bdflib.c, (2) sfnt/ttcmap.c, (3) cff/cffgload.c, and (4) the read_lwfn function and a crafted LWFN file in base/ftmac.c. NOTE: item 4 was originally identified by CVE-2006-2493.
Exploit likelihood
What each source reports
NVD Score used
Multiple integer overflows in FreeType before 2.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attack vectors related to (1) bdf/bdflib.c, (2) sfnt/ttcmap.c, (3) cff/cffgload.c, and (4) the read_lwfn function and a crafted LWFN file in base/ftmac.c. NOTE: item 4 was originally identified by CVE-2006-2493.
- Record
CVE-2006-1861- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Multiple integer overflows in FreeType before 2.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attack vectors related to (1) bdf/bdflib.c, (2) sfnt/ttcmap.c, (3) cff/cffgload.c, and (4) the read_lwfn function and a crafted LWFN file in base/ftmac.c. NOTE: item 4 was originally identified by CVE-2006-2493.
- Record
CVE-2006-1861- Updated
- 2026-11-02
EUVDEUVD-2006-1861 No score
Multiple integer overflows in FreeType before 2.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attack vectors related to (1) bdf/bdflib.c, (2) sfnt/ttcmap.c, (3) cff/cffgload.c, and (4) the read_lwfn function and a crafted LWFN file in base/ftmac.c. NOTE: item 4 was originally identified by CVE-2006-2493.
- Record
EUVD-2006-1861- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6pg6-7h2x-863m No score
Multiple integer overflows in FreeType before 2.2 allow remote attackers to cause a denial of...
Multiple integer overflows in FreeType before 2.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attack vectors related to (1) bdf/bdflib.c, (2) sfnt/ttcmap.c, (3) cff/cffgload.c, and (4) the read_lwfn function and a crafted LWFN file in base/ftmac.c. NOTE: item 4 was originally identified by CVE-2006-2493.
- Record
GHSA-6pg6-7h2x-863m- Updated
- 2026-11-02
OSVBELL-CVE-2006-1861
CVE-2006-1861 does not affect BellSoft software
- Record
BELL-CVE-2006-1861- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
OSV No score
Multiple integer overflows in FreeType before 2.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attack vectors related to (1) bdf/bdflib.c, (2) sfnt/ttcmap.c, (3) cff/cffgload.c, and (4) the read_lwfn function and a crafted LWFN file in base/ftmac.c. NOTE: item 4 was originally identified by CVE-2006-2493.
- Record
CVE-2006-1861- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-1861 No score
Multiple integer overflows in FreeType before 2.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via attack vectors related to (1) bdf/bdflib.c, (2) sfnt/ttcmap.c, (3) cff/cffgload.c, and (4) the read_lwfn function and a crafted LWFN file in base/ftmac.c. NOTE: item 4 was originally identified by CVE-2006-2493.
- Record
DEBIAN-CVE-2006-1861- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
freetypeDebian:12 |
before 2.2.1-1 | 2.2.1-1 |
freetypeDebian:13 |
before 2.2.1-1 | 2.2.1-1 |
freetypeDebian:14 |
before 2.2.1-1 | 2.2.1-1 |
freetypeDebian:3.0 |
before 2.0.9-1woody1, plus listed versions 2.0.9-1 |
2.0.9-1woody1 |
freetypeDebian:3.1 |
before 2.1.7-2.5, plus listed versions 2.1.7-2.4 |
2.1.7-2.5 |
freetypeRed Hat:enterprise_linux:3::as |
before 0:2.1.4-4.0.rhel3.2 | 0:2.1.4-4.0.rhel3.2 |
freetype-debuginfoRed Hat:enterprise_linux:3::as |
before 0:2.1.4-4.0.rhel3.2 | 0:2.1.4-4.0.rhel3.2 |
freetype-develRed Hat:enterprise_linux:3::as |
before 0:2.1.4-4.0.rhel3.2 | 0:2.1.4-4.0.rhel3.2 |
freetypeRed Hat:enterprise_linux:3::desktop |
before 0:2.1.4-4.0.rhel3.2 | 0:2.1.4-4.0.rhel3.2 |
freetype-debuginfoRed Hat:enterprise_linux:3::desktop |
before 0:2.1.4-4.0.rhel3.2 | 0:2.1.4-4.0.rhel3.2 |
Show 71 moreShow less
| Package | Affected | Fixed |
|---|---|---|
freetype-develRed Hat:enterprise_linux:3::desktop |
before 0:2.1.4-4.0.rhel3.2 | 0:2.1.4-4.0.rhel3.2 |
freetypeRed Hat:enterprise_linux:3::es |
before 0:2.1.4-4.0.rhel3.2 | 0:2.1.4-4.0.rhel3.2 |
freetype-debuginfoRed Hat:enterprise_linux:3::es |
before 0:2.1.4-4.0.rhel3.2 | 0:2.1.4-4.0.rhel3.2 |
freetype-develRed Hat:enterprise_linux:3::es |
before 0:2.1.4-4.0.rhel3.2 | 0:2.1.4-4.0.rhel3.2 |
freetypeRed Hat:enterprise_linux:3::ws |
before 0:2.1.4-4.0.rhel3.2 | 0:2.1.4-4.0.rhel3.2 |
freetype-debuginfoRed Hat:enterprise_linux:3::ws |
before 0:2.1.4-4.0.rhel3.2 | 0:2.1.4-4.0.rhel3.2 |
freetype-develRed Hat:enterprise_linux:3::ws |
before 0:2.1.4-4.0.rhel3.2 | 0:2.1.4-4.0.rhel3.2 |
freetypeRed Hat:enterprise_linux:4::as |
before 0:2.1.9-1.rhel4.4 | 0:2.1.9-1.rhel4.4 |
freetype-debuginfoRed Hat:enterprise_linux:4::as |
before 0:2.1.9-1.rhel4.4 | 0:2.1.9-1.rhel4.4 |
freetype-demosRed Hat:enterprise_linux:4::as |
before 0:2.1.9-1.rhel4.4 | 0:2.1.9-1.rhel4.4 |
freetype-develRed Hat:enterprise_linux:4::as |
before 0:2.1.9-1.rhel4.4 | 0:2.1.9-1.rhel4.4 |
freetype-utilsRed Hat:enterprise_linux:4::as |
before 0:2.1.9-1.rhel4.4 | 0:2.1.9-1.rhel4.4 |
freetypeRed Hat:enterprise_linux:4::desktop |
before 0:2.1.9-1.rhel4.4 | 0:2.1.9-1.rhel4.4 |
freetype-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:2.1.9-1.rhel4.4 | 0:2.1.9-1.rhel4.4 |
freetype-demosRed Hat:enterprise_linux:4::desktop |
before 0:2.1.9-1.rhel4.4 | 0:2.1.9-1.rhel4.4 |
freetype-develRed Hat:enterprise_linux:4::desktop |
before 0:2.1.9-1.rhel4.4 | 0:2.1.9-1.rhel4.4 |
freetype-utilsRed Hat:enterprise_linux:4::desktop |
before 0:2.1.9-1.rhel4.4 | 0:2.1.9-1.rhel4.4 |
freetypeRed Hat:enterprise_linux:4::es |
before 0:2.1.9-1.rhel4.4 | 0:2.1.9-1.rhel4.4 |
freetype-debuginfoRed Hat:enterprise_linux:4::es |
before 0:2.1.9-1.rhel4.4 | 0:2.1.9-1.rhel4.4 |
freetype-demosRed Hat:enterprise_linux:4::es |
before 0:2.1.9-1.rhel4.4 | 0:2.1.9-1.rhel4.4 |
freetype-develRed Hat:enterprise_linux:4::es |
before 0:2.1.9-1.rhel4.4 | 0:2.1.9-1.rhel4.4 |
freetype-utilsRed Hat:enterprise_linux:4::es |
before 0:2.1.9-1.rhel4.4 | 0:2.1.9-1.rhel4.4 |
freetypeRed Hat:enterprise_linux:4::ws |
before 0:2.1.9-1.rhel4.4 | 0:2.1.9-1.rhel4.4 |
freetype-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:2.1.9-1.rhel4.4 | 0:2.1.9-1.rhel4.4 |
freetype-demosRed Hat:enterprise_linux:4::ws |
before 0:2.1.9-1.rhel4.4 | 0:2.1.9-1.rhel4.4 |
freetype-develRed Hat:enterprise_linux:4::ws |
before 0:2.1.9-1.rhel4.4 | 0:2.1.9-1.rhel4.4 |
freetype-utilsRed Hat:enterprise_linux:4::ws |
before 0:2.1.9-1.rhel4.4 | 0:2.1.9-1.rhel4.4 |
freetypeRed Hat:enterprise_linux:3::as |
before 0:2.1.4-12.el3 | 0:2.1.4-12.el3 |
freetype-debuginfoRed Hat:enterprise_linux:3::as |
before 0:2.1.4-12.el3 | 0:2.1.4-12.el3 |
freetype-develRed Hat:enterprise_linux:3::as |
before 0:2.1.4-12.el3 | 0:2.1.4-12.el3 |
freetypeRed Hat:enterprise_linux:3::desktop |
before 0:2.1.4-12.el3 | 0:2.1.4-12.el3 |
freetype-debuginfoRed Hat:enterprise_linux:3::desktop |
before 0:2.1.4-12.el3 | 0:2.1.4-12.el3 |
freetype-develRed Hat:enterprise_linux:3::desktop |
before 0:2.1.4-12.el3 | 0:2.1.4-12.el3 |
freetypeRed Hat:enterprise_linux:3::es |
before 0:2.1.4-12.el3 | 0:2.1.4-12.el3 |
freetype-debuginfoRed Hat:enterprise_linux:3::es |
before 0:2.1.4-12.el3 | 0:2.1.4-12.el3 |
freetype-develRed Hat:enterprise_linux:3::es |
before 0:2.1.4-12.el3 | 0:2.1.4-12.el3 |
freetypeRed Hat:enterprise_linux:3::ws |
before 0:2.1.4-12.el3 | 0:2.1.4-12.el3 |
freetype-debuginfoRed Hat:enterprise_linux:3::ws |
before 0:2.1.4-12.el3 | 0:2.1.4-12.el3 |
freetype-develRed Hat:enterprise_linux:3::ws |
before 0:2.1.4-12.el3 | 0:2.1.4-12.el3 |
freetypeRed Hat:enterprise_linux:4::as |
before 0:2.1.9-10.el4.7 | 0:2.1.9-10.el4.7 |
freetype-debuginfoRed Hat:enterprise_linux:4::as |
before 0:2.1.9-10.el4.7 | 0:2.1.9-10.el4.7 |
freetype-demosRed Hat:enterprise_linux:4::as |
before 0:2.1.9-10.el4.7 | 0:2.1.9-10.el4.7 |
freetype-develRed Hat:enterprise_linux:4::as |
before 0:2.1.9-10.el4.7 | 0:2.1.9-10.el4.7 |
freetype-utilsRed Hat:enterprise_linux:4::as |
before 0:2.1.9-10.el4.7 | 0:2.1.9-10.el4.7 |
freetypeRed Hat:enterprise_linux:4::desktop |
before 0:2.1.9-10.el4.7 | 0:2.1.9-10.el4.7 |
freetype-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:2.1.9-10.el4.7 | 0:2.1.9-10.el4.7 |
freetype-demosRed Hat:enterprise_linux:4::desktop |
before 0:2.1.9-10.el4.7 | 0:2.1.9-10.el4.7 |
freetype-develRed Hat:enterprise_linux:4::desktop |
before 0:2.1.9-10.el4.7 | 0:2.1.9-10.el4.7 |
freetype-utilsRed Hat:enterprise_linux:4::desktop |
before 0:2.1.9-10.el4.7 | 0:2.1.9-10.el4.7 |
freetypeRed Hat:enterprise_linux:4::es |
before 0:2.1.9-10.el4.7 | 0:2.1.9-10.el4.7 |
freetype-debuginfoRed Hat:enterprise_linux:4::es |
before 0:2.1.9-10.el4.7 | 0:2.1.9-10.el4.7 |
freetype-demosRed Hat:enterprise_linux:4::es |
before 0:2.1.9-10.el4.7 | 0:2.1.9-10.el4.7 |
freetype-develRed Hat:enterprise_linux:4::es |
before 0:2.1.9-10.el4.7 | 0:2.1.9-10.el4.7 |
freetype-utilsRed Hat:enterprise_linux:4::es |
before 0:2.1.9-10.el4.7 | 0:2.1.9-10.el4.7 |
freetypeRed Hat:enterprise_linux:4::ws |
before 0:2.1.9-10.el4.7 | 0:2.1.9-10.el4.7 |
freetype-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:2.1.9-10.el4.7 | 0:2.1.9-10.el4.7 |
freetype-demosRed Hat:enterprise_linux:4::ws |
before 0:2.1.9-10.el4.7 | 0:2.1.9-10.el4.7 |
freetype-develRed Hat:enterprise_linux:4::ws |
before 0:2.1.9-10.el4.7 | 0:2.1.9-10.el4.7 |
freetype-utilsRed Hat:enterprise_linux:4::ws |
before 0:2.1.9-10.el4.7 | 0:2.1.9-10.el4.7 |
freetypeRed Hat:enterprise_linux:2.1::as |
before 0:2.0.3-17.el21 | 0:2.0.3-17.el21 |
freetype-develRed Hat:enterprise_linux:2.1::as |
before 0:2.0.3-17.el21 | 0:2.0.3-17.el21 |
freetype-utilsRed Hat:enterprise_linux:2.1::as |
before 0:2.0.3-17.el21 | 0:2.0.3-17.el21 |
freetypeRed Hat:enterprise_linux:2.1::aw |
before 0:2.0.3-17.el21 | 0:2.0.3-17.el21 |
freetype-develRed Hat:enterprise_linux:2.1::aw |
before 0:2.0.3-17.el21 | 0:2.0.3-17.el21 |
freetype-utilsRed Hat:enterprise_linux:2.1::aw |
before 0:2.0.3-17.el21 | 0:2.0.3-17.el21 |
freetypeRed Hat:enterprise_linux:2.1::es |
before 0:2.0.3-17.el21 | 0:2.0.3-17.el21 |
freetype-develRed Hat:enterprise_linux:2.1::es |
before 0:2.0.3-17.el21 | 0:2.0.3-17.el21 |
freetype-utilsRed Hat:enterprise_linux:2.1::es |
before 0:2.0.3-17.el21 | 0:2.0.3-17.el21 |
freetypeRed Hat:enterprise_linux:2.1::ws |
before 0:2.0.3-17.el21 | 0:2.0.3-17.el21 |
freetype-develRed Hat:enterprise_linux:2.1::ws |
before 0:2.0.3-17.el21 | 0:2.0.3-17.el21 |
freetype-utilsRed Hat:enterprise_linux:2.1::ws |
before 0:2.0.3-17.el21 | 0:2.0.3-17.el21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-1861 is a high vulnerability (CVSS 7.5) in Freetype, published May 23, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.81%, the 92nd percentile. Fixed in freetype 2.2.1-1.
References
lists.suse.com/archive/suse-security-announce/2006-Jun/0012.html
secunia.com/advisories/20791
sourceforge.net/project/shownotes.php?release_id=416463
sunsolve.sun.com/search/document.do?assetkey=1-26-102705-1
Show 82 moreShow less
security.gentoo.org/glsa/glsa-200607-02.xml
support.apple.com/kb/HT3438
redhat.com/archives/fedora-package-announce/2009-May/msg01401.html
lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
usn.ubuntu.com/291-1
securityfocus.com/archive/1/436836/100/0/threaded
exchange.xforce.ibmcloud.com/vulnerabilities/26553
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9124
bugzilla.redhat.com/show_bug.cgi?id=502565
support.avaya.com/elmodocs2/security/ASA-2006-176.htm
lists.opensuse.org/opensuse-security-announce/2007-10/msg00006.html
securitytracker.com/id?1016522
vupen.com/english/advisories/2007/0381
issues.rpath.com/browse/RPL-429
gentoo.org/security/en/glsa/glsa-200710-09.xml
mandriva.com/security/advisories?name=MDKSA-2006:099
debian.org/security/2006/dsa-1095
nvd.nist.gov/vuln/detail/CVE-2006-1861
github.com/advisories/GHSA-6pg6-7h2x-863m
docs.bell-sw.com/security/cves/CVE-2006-1861
security-tracker.debian.org/tracker/CVE-2006-1861
access.redhat.com/errata/RHSA-2006:0500
security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0500.json
cve.org/CVERecord?id=CVE-2006-0747