{"id":"CVE-2014-2241","aliases":["DEBIAN-CVE-2014-2241","EUVD-2014-2280","GHSA-39qr-hvc6-f2x3","MGASA-2014-0130","SUSE-SU-2025:20204-1","openSUSE-SU-2024:10438-1"],"status":"published","title":"The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in...","description":"The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service (assertion failure), as demonstrated by a crafted ttf file.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01897,"percentile":0.79782,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2014-03-15T16:26:54Z","modified":"2026-10-23T15:47:36Z","fixes":[{"ecosystem":"Debian:12","package":"freetype","fixed_in":["2.5.2-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"freetype","fixed_in":["2.5.2-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"freetype","fixed_in":["2.5.2-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-1.1"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0.1-3.1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0.1-3.1.mga4.tainted"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.3-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-1.1"}]}],"bundled":55}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"freetype","product":"freetype"}],"references":[{"url":"http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=135c3faebb96f8f550bd4f318716f2e1e095a969","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"http://www.ubuntu.com/usn/USN-2148-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/57447","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://savannah.nongnu.org/bugs/?41697","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2014/03/12/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2241"},{"url":"https://github.com/advisories/GHSA-39qr-hvc6-f2x3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-2241","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0130.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12986","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1074646","tags":["report"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=741299","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520204-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1035807","tags":["report"]},{"url":"https://bugzilla.suse.com/1036457","tags":["report"]},{"url":"https://bugzilla.suse.com/1079600","tags":["report"]},{"url":"https://bugzilla.suse.com/1198823","tags":["report"]},{"url":"https://bugzilla.suse.com/1198830","tags":["report"]},{"url":"https://bugzilla.suse.com/1198832","tags":["report"]},{"url":"https://bugzilla.suse.com/867620","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27406","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9675","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-2241","description":"The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service (assertion failure), as demonstrated by a crafted ttf file.","status":"published","published":"2014-03-18T14:00:00Z","modified":"2024-08-06T10:06:00.393Z","updated_at":"2026-11-02T14:33:43.566796Z"}],"euvd":[{"id":"EUVD-2014-2280","description":"The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service (assertion failure), as demonstrated by a crafted ttf file.","status":"published","published":"2014-03-18T14:00:00Z","modified":"2024-08-06T10:06:00Z","updated_at":"2026-11-03T01:57:14.847023Z"}],"ghsa":[{"id":"GHSA-39qr-hvc6-f2x3","title":"The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in...","description":"The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service (assertion failure), as demonstrated by a crafted ttf file.","status":"published","published":"2022-05-17T04:48:10Z","modified":"2023-01-28T05:02:25Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:43:46.718397Z"}],"nvd":[{"id":"CVE-2014-2241","description":"The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service (assertion failure), as demonstrated by a crafted ttf file.","status":"published","published":"2014-03-18T17:04:18.14Z","modified":"2026-06-17T00:06:16.65Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:53.710973Z"}],"osv":[{"id":"CVE-2014-2241","description":"The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service (assertion failure), as demonstrated by a crafted ttf file.","status":"published","published":"2014-03-18T17:04:18Z","modified":"2026-04-16T06:16:49.757052471Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-2241","description":"The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service (assertion failure), as demonstrated by a crafted ttf file.","status":"published","published":"2014-03-18T17:04:18.14Z","modified":"2026-10-23T15:47:36.032959335Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"MGASA-2014-0130","title":"Updated freetype2 packages fix security vulnerabilities","description":"It was reported that Freetype before 2.5.3 suffers from an out-of-bounds\nstack-based read/write flaw in cf2_hintmap_build() in the CFF rasterizing\ncode, which could lead to a buffer overflow (CVE-2014-2240).\n\nIt was also reported that Freetype before 2.5.3 has a denial-of-service\nvulnerability in the CFF rasterizing code, due to a reachable assertion\n(CVE-2014-2241).\n","status":"published","published":"2014-03-15T16:26:54Z","modified":"2026-04-16T06:24:35.816419477Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10438-1","title":"freetype2-devel-2.7-1.1 on GA media","description":"These are all security issues fixed in the freetype2-devel-2.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:51:23.693084Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2025:20204-1","title":"Security update for freetype2","description":"This update for freetype2 fixes the following issues:\n\nUpdate to 2.13.2:\n\n* Some fields in the `FT_Outline` structure have been changed\n  from signed to unsigned type, which better reflects the actual\n  usage. It is also an additional means to protect against\n  malformed input.\n* Rare double-free crashes in the cache subsystem have been fixed.\n* Excessive stack allocation in the autohinter has been fixed.\n* The B/W  rasterizer has received a major upkeep that results in\n  large performance improvements.  The rendering speed has\n  increased and even doubled for very complex glyphs.\n","status":"published","published":"2025-04-24T14:44:51Z","modified":"2026-03-23T04:48:53.151267Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}