{"id":"CVE-2009-0946","aliases":["DEBIAN-CVE-2009-0946","DSA-1784-1","EUVD-2009-0943","GHSA-g82w-w4fh-33xc","RHSA-2009:0329","RHSA-2009:1061","RHSA-2009:1062","openSUSE-SU-2024:10172-1","openSUSE-SU-2024:10438-1"],"status":"published","title":"Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute...","description":"Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.08541,"percentile":0.95092,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2009-04-17T00:00:00Z","modified":"2026-10-23T17:47:47Z","fixes":[{"ecosystem":"Debian:12","package":"freetype","fixed_in":["2.3.9-4.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"freetype","fixed_in":["2.3.9-4.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"freetype","fixed_in":["2.3.9-4.1"],"sources":["osv"]},{"ecosystem":"Debian:4.0","package":"freetype","fixed_in":["2.2.1-5+etch4"],"sources":["osv"]},{"ecosystem":"Debian:5.0","package":"freetype","fixed_in":["2.3.7-2+lenny1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"freetype","fixed_in":["0:2.2.1-21.el5_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"freetype-debuginfo","fixed_in":["0:2.2.1-21.el5_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"freetype-demos","fixed_in":["0:2.2.1-21.el5_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"freetype-devel","fixed_in":["0:2.2.1-21.el5_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"freetype","fixed_in":["0:2.2.1-21.el5_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"freetype-debuginfo","fixed_in":["0:2.2.1-21.el5_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"freetype","fixed_in":["0:2.2.1-21.el5_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"freetype-debuginfo","fixed_in":["0:2.2.1-21.el5_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"freetype-demos","fixed_in":["0:2.2.1-21.el5_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"freetype-devel","fixed_in":["0:2.2.1-21.el5_3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.9-4.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.9-4.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.9-4.1"}]}]},{"source":"osv","ecosystem":"Debian:4.0","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-5+etch4"}]}],"versions":["2.2.1-5","2.2.1-5+etch1","2.2.1-5+etch2","2.2.1-5+etch3"]},{"source":"osv","ecosystem":"Debian:5.0","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.7-2+lenny1"}]}],"versions":["2.3.7-2"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::as","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-12.el3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::as","package":"freetype-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-12.el3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::as","package":"freetype-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-12.el3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-12.el3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"freetype-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-12.el3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"freetype-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-12.el3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::es","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-12.el3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::es","package":"freetype-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-12.el3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::es","package":"freetype-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-12.el3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::ws","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-12.el3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::ws","package":"freetype-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-12.el3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::ws","package":"freetype-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.4-12.el3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-10.el4.7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"freetype-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-10.el4.7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"freetype-demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-10.el4.7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"freetype-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-10.el4.7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"freetype-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-10.el4.7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-10.el4.7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"freetype-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-10.el4.7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"freetype-demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-10.el4.7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"freetype-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-10.el4.7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"freetype-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-10.el4.7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-10.el4.7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"freetype-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-10.el4.7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"freetype-demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-10.el4.7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"freetype-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-10.el4.7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"freetype-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-10.el4.7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-10.el4.7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"freetype-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-10.el4.7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"freetype-demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-10.el4.7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"freetype-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-10.el4.7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"freetype-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.9-10.el4.7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.1-21.el5_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"freetype-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.1-21.el5_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"freetype-demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.1-21.el5_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"freetype-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.1-21.el5_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.1-21.el5_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"freetype-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.1-21.el5_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.1-21.el5_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"freetype-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.1-21.el5_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"freetype-demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.1-21.el5_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"freetype-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.1-21.el5_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:2.1::as","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-17.el21"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:2.1::as","package":"freetype-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-17.el21"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:2.1::as","package":"freetype-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-17.el21"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:2.1::aw","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-17.el21"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:2.1::aw","package":"freetype-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-17.el21"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:2.1::aw","package":"freetype-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-17.el21"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:2.1::es","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-17.el21"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:2.1::es","package":"freetype-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-17.el21"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:2.1::es","package":"freetype-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-17.el21"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:2.1::ws","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-17.el21"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:2.1::ws","package":"freetype-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-17.el21"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:2.1::ws","package":"freetype-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-17.el21"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ft2demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-1.1"}]}],"bundled":32},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-1.1"}]}],"bundled":55}],"products":[{"vendor":"apple","product":"iphone_os"},{"vendor":"apple","product":"mac_os_x"},{"vendor":"apple","product":"mac_os_x_server"},{"vendor":"apple","product":"safari"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"freetype","product":"freetype"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"suse","product":"linux_enterprise_server"}],"references":[{"url":"http://secunia.com/advisories/34967","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://support.apple.com/kb/HT3639","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://support.apple.com/kb/HT4435","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","web"]},{"url":"http://secunia.com/advisories/34913","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=a18788b14db60ae3673f932249cd02d33a227c4e","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"http://www.vupen.com/english/advisories/2009/1621","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/34550","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://support.apple.com/kb/HT3549","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2009:243","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Broken Link","web"]},{"url":"http://www.ubuntu.com/usn/USN-767-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-66-270268-1","tags":["vendor-advisory","x_refsource_SUNALERT","x_transferred","Broken Link","web"]},{"url":"http://secunia.com/advisories/35198","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=79972af4f0485a11dcb19551356c45245749fc5b","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"http://secunia.com/advisories/35074","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0545ec1ca36b27cb928128870a83e5f668980bc5","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"http://www.vupen.com/english/advisories/2009/1522","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.redhat.com/support/errata/RHSA-2009-1062.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://lists.apple.com/archives/security-announce/2009/May/msg00002.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://secunia.com/advisories/35065","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2009/dsa-1784","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/35210","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://security.gentoo.org/glsa/glsa-200905-05.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/35379","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=491384","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","advisory","fix","report"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10149","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","Third Party Advisory","advisory"]},{"url":"http://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/ChangeLog","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA09-133A.html","tags":["third-party-advisory","x_refsource_CERT","x_transferred","Third Party Advisory","US Government Resource","advisory","web"]},{"url":"http://www.vupen.com/english/advisories/2009/1297","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/35200","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://support.apple.com/kb/HT3613","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2009-0329.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.vupen.com/english/advisories/2009/1058","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/35204","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/34723","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2009-1061.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-0946","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g82w-w4fh-33xc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2009-0946","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2009:0329","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"http://www.redhat.com/support/policy/soc/production/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=240200","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=450774","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=484437","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0329.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2006-1861","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-1861","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-1861","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-2754","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-2754","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-2754","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2008-1808","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-1808","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-1808","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-0946","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-0946","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2009:1061","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1061.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2009:1062","tags":["advisory"]},{"url":"http://www.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1062.json","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2241","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2009-0946","description":"Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.","status":"published","published":"2009-04-17T00:00:00Z","modified":"2024-08-07T04:57:17.538Z","updated_at":"2026-11-02T14:33:26.302774Z"}],"euvd":[{"id":"EUVD-2009-0943","description":"Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.","status":"published","published":"2009-04-17T00:00:00Z","modified":"2024-08-07T04:57:17Z","updated_at":"2026-11-03T01:39:23.782527Z"}],"ghsa":[{"id":"GHSA-g82w-w4fh-33xc","title":"Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute...","description":"Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.","status":"published","published":"2022-05-02T03:19:59Z","modified":"2023-01-31T05:06:57Z","cwes":["CWE-190"],"updated_at":"2026-11-02T14:49:07.319467Z"}],"nvd":[{"id":"CVE-2009-0946","description":"Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.","status":"published","published":"2009-04-17T00:30:00.25Z","modified":"2026-06-16T23:06:10.3Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:01:35.136779Z"}],"osv":[{"id":"CVE-2009-0946","description":"Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.","status":"published","published":"2009-04-17T00:30:00Z","modified":"2026-04-10T03:40:40.860535Z","updated_at":"2026-11-02T15:43:57.452479Z"},{"id":"DEBIAN-CVE-2009-0946","description":"Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.","status":"published","published":"2009-04-17T00:30:00.25Z","modified":"2026-10-23T17:47:47.18917618Z","updated_at":"2026-11-02T15:45:24.013654Z"},{"id":"DSA-1784-1","title":"freetype - arbitrary code execution","status":"published","published":"2009-04-30T00:00:00Z","modified":"2026-03-09T01:21:12.595932Z","updated_at":"2026-11-02T15:46:14.734124Z"},{"id":"openSUSE-SU-2024:10172-1","title":"ft2demos-2.7-1.1 on GA media","description":"These are all security issues fixed in the ft2demos-2.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:11:32.890732Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10438-1","title":"freetype2-devel-2.7-1.1 on GA media","description":"These are all security issues fixed in the freetype2-devel-2.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:51:23.693084Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"RHSA-2009:0329","title":"Red Hat Security Advisory: freetype security update","status":"published","published":"2024-09-15T17:46:11Z","modified":"2026-06-26T10:10:38Z","updated_at":"2026-11-02T15:53:00.468834Z"},{"id":"RHSA-2009:1061","title":"Red Hat Security Advisory: freetype security update","status":"published","published":"2024-09-15T17:46:15Z","modified":"2026-06-26T12:18:40.192837675Z","updated_at":"2026-11-02T15:53:00.468834Z"},{"id":"RHSA-2009:1062","title":"Red Hat Security Advisory: freetype security update","status":"published","published":"2024-09-15T17:46:19Z","modified":"2026-06-26T10:11:16Z","updated_at":"2026-11-02T15:53:00.468834Z"}]}}