{"id":"CVE-2015-9383","aliases":["DEBIAN-CVE-2015-9383","DLA-1909-1","EUVD-2015-9223","GHSA-5qxc-8vc2-mr95","UBUNTU-CVE-2015-9383","USN-4126-1","USN-4126-2"],"status":"published","title":"FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.","description":"FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02281,"percentile":0.83257,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2019-09-03T00:00:00Z","modified":"2026-09-09T07:02:07Z","fixes":[{"ecosystem":"Debian:12","package":"freetype","fixed_in":["2.6.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"freetype","fixed_in":["2.6.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"freetype","fixed_in":["2.6.3-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"freetype","fixed_in":["2.5.2-1ubuntu2.8+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"freetype","fixed_in":["2.6.1-0.1ubuntu2.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-3+deb8u4"}]}],"versions":["2.5.2-3","2.5.2-3+deb8u1","2.5.2-3+deb8u1~kbsd8u1","2.5.2-3+deb8u2","2.5.2-3+deb8u3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-1ubuntu2.8+esm1"}]}],"versions":["2.4.12-0ubuntu1","2.5.0.1-0ubuntu2","2.5.1-1ubuntu1","2.5.1-1ubuntu2","2.5.1-2ubuntu1","2.5.2-1ubuntu1","2.5.2-1ubuntu2","2.5.2-1ubuntu2.1","2.5.2-1ubuntu2.2","2.5.2-1ubuntu2.3","2.5.2-1ubuntu2.4","2.5.2-1ubuntu2.5","2.5.2-1ubuntu2.6","2.5.2-1ubuntu2.7","2.5.2-1ubuntu2.8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-0.1ubuntu2.4"}]}],"versions":["2.5.2-4ubuntu2","2.6.1-0.1ubuntu1","2.6.1-0.1ubuntu2","2.6.1-0.1ubuntu2.1","2.6.1-0.1ubuntu2.2","2.6.1-0.1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-0.1ubuntu2.4"}]}],"versions":["2.5.2-4ubuntu2","2.6.1-0.1ubuntu1","2.6.1-0.1ubuntu2","2.6.1-0.1ubuntu2.1","2.6.1-0.1ubuntu2.2","2.6.1-0.1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-1ubuntu2.8+esm1"}]}],"versions":["2.4.12-0ubuntu1","2.5.0.1-0ubuntu2","2.5.1-1ubuntu1","2.5.1-1ubuntu2","2.5.1-2ubuntu1","2.5.2-1ubuntu1","2.5.2-1ubuntu2","2.5.2-1ubuntu2.1","2.5.2-1ubuntu2.2","2.5.2-1ubuntu2.3","2.5.2-1ubuntu2.4","2.5.2-1ubuntu2.5","2.5.2-1ubuntu2.6","2.5.2-1ubuntu2.7","2.5.2-1ubuntu2.8"],"bundled":3}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"freetype","product":"freetype"}],"references":[{"url":"http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=57cbb8c148999ba8f14ed53435fc071ac9953afd","tags":["x_refsource_MISC","x_transferred","Patch","fix","report"]},{"url":"https://savannah.nongnu.org/bugs/?46346","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","advisory","evidence","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/09/msg00002.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://usn.ubuntu.com/4126-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4126-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-9383"},{"url":"https://github.com/advisories/GHSA-5qxc-8vc2-mr95"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-9383","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-9383","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4126-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4126-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-9383","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-9381","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-9382","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-9383","description":"FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.","status":"published","published":"2019-09-03T04:52:27Z","modified":"2024-08-06T08:51:03.36Z","updated_at":"2026-11-02T14:35:40.591596Z"}],"euvd":[{"id":"EUVD-2015-9223","description":"FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.","status":"published","published":"2019-09-03T04:52:27Z","modified":"2024-08-06T08:51:03Z","updated_at":"2026-11-03T01:57:24.304302Z"}],"ghsa":[{"id":"GHSA-5qxc-8vc2-mr95","title":"FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.","description":"FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.","status":"published","published":"2022-05-24T16:55:20Z","modified":"2023-03-03T05:08:27Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:54:15.627441Z"}],"nvd":[{"id":"CVE-2015-9383","description":"FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.","status":"published","published":"2019-09-03T05:15:10.887Z","modified":"2026-06-17T00:36:24.463Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:03:19.73542Z"}],"osv":[{"id":"CVE-2015-9383","description":"FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.","status":"published","published":"2019-09-03T05:15:10Z","modified":"2026-04-10T03:46:36.777384Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-9383","description":"FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.","status":"published","published":"2019-09-03T05:15:10.887Z","modified":"2026-09-09T07:02:07.218900785Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2015-9383","description":"FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.","status":"published","published":"2019-09-03T00:00:00Z","modified":"2026-04-22T10:25:57.266358Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:11.100633Z"},{"id":"DLA-1909-1","title":"freetype - security update","status":"published","published":"2019-09-04T00:00:00Z","modified":"2026-03-09T01:23:17.468443Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"USN-4126-1","title":"freetype vulnerability","description":"It was discovered that FreeType incorrectly handled certain font files.\nAn attacker could possibly use this issue to access sensitive information.\n","status":"published","published":"2019-09-09T16:30:01Z","modified":"2026-04-22T09:59:23.783739Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-4126-2","title":"freetype vulnerabilities","description":"USN-4126-1 fixed a vulnerability in FreeType. This update provides\nthe corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.\n\nIt was discovered that FreeType incorrectly handled certain font files.\nAn attacker could possibly use this issue to access sensitive information.\n(CVE-2015-9381, CVE-2015-9382)\n\nOriginal advisory details:\n\n It was discovered that FreeType incorrectly handled certain font files.\n An attacker could possibly use this issue to access sensitive information.\n (CVE-2015-9383)\n","status":"published","published":"2019-09-09T19:06:18Z","modified":"2026-04-22T10:00:36.54409Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}