{"id":"CVE-2017-7864","aliases":["EUVD-2017-16839","GHSA-8hj9-h89q-ppcg","MGASA-2018-0128","SUSE-SU-2018:0414-1"],"status":"published","title":"FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow...","description":"FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tt_size_reset function in truetype/ttobjs.c.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03771,"percentile":0.90004,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2017-04-14T04:30:00Z","modified":"2026-11-01T10:45:07Z","fixes":[{"ecosystem":"Mageia:6","package":"freetype2","fixed_in":["2.7.1-2.1.mga6","2.7.1-2.1.mga6.tainted"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:6","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-2.1.mga6"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-2.1.mga6.tainted"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-7.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"ft2demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-7.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-7.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"ft2demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-7.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-7.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"ft2demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-7.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-7.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-7.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-7.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"ft2demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-7.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-7.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"ft2demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-7.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-7.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"ft2demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-7.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-7.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"ft2demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-7.15.1"}]}],"bundled":4}],"products":[{"vendor":"freetype","product":"freetype"}],"references":[{"url":"http://www.securityfocus.com/bid/97673","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/201706-14","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=e6699596af5c5d6f0ae0ea06e19df87dce088df8","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=509","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7864"},{"url":"https://github.com/advisories/GHSA-8hj9-h89q-ppcg"},{"url":"https://advisories.mageia.org/MGASA-2018-0128.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22563","tags":["report"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1034178","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180414-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1028103","tags":["report"]},{"url":"https://bugzilla.suse.com/1035807","tags":["report"]},{"url":"https://bugzilla.suse.com/1036457","tags":["report"]},{"url":"https://bugzilla.suse.com/1079600","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8287","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-7864","description":"FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tt_size_reset function in truetype/ttobjs.c.","status":"published","published":"2017-04-14T04:30:00Z","modified":"2024-08-05T16:19:28.52Z","updated_at":"2026-11-02T14:33:20.488433Z"}],"euvd":[{"id":"EUVD-2017-16839","description":"FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tt_size_reset function in truetype/ttobjs.c.","status":"published","published":"2017-04-14T04:30:00Z","modified":"2024-08-05T16:19:28Z","updated_at":"2026-11-03T02:39:07.019497Z"}],"ghsa":[{"id":"GHSA-8hj9-h89q-ppcg","title":"FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow...","description":"FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tt_size_reset function in truetype/ttobjs.c.","status":"published","published":"2022-05-13T01:12:01Z","modified":"2023-02-01T05:03:55Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:50:06.799159Z"}],"nvd":[{"id":"CVE-2017-7864","description":"FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tt_size_reset function in truetype/ttobjs.c.","status":"published","published":"2017-04-14T04:59:00.557Z","modified":"2026-06-17T01:25:21.973Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:03:46.08744Z"}],"osv":[{"id":"CVE-2017-7864","description":"FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tt_size_reset function in truetype/ttobjs.c.","status":"published","published":"2017-04-14T04:59:00.557Z","modified":"2026-11-08T10:45:05.746574073Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-08T11:04:08.386699Z"},{"id":"MGASA-2018-0128","title":"Updated freetype2 packages fix security vulnerability","description":"Updated freetype2 packages fix security vulnerability:\n\nFreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based\nbuffer overflow related to the tt_size_reset function in truetype/ttobjs.c\n(CVE-2017-7864).\n","status":"published","published":"2018-02-15T21:17:42Z","modified":"2026-04-16T06:24:59.485706876Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"SUSE-SU-2018:0414-1","title":"Security update for freetype2","description":"\n  \nThis update for freetype2 fixes the following security issues:\n\n- CVE-2016-10244: Make sure that the parse_charstrings function in\n  type1/t1load.c does ensure that a font contains a glyph name to prevent a DoS\n  through a heap-based buffer over-read or possibly have unspecified other\n  impact via a crafted file (bsc#1028103)\n- CVE-2017-8105: Fix an out-of-bounds write caused by a heap-based\n  buffer overflow related to the t1_decoder_parse_charstrings function in\n  psaux/t1decode.ca (bsc#1035807)\n- CVE-2017-8287: an out-of-bounds write caused by a heap-based buffer\n  overflow related to the t1_builder_close_contour function in psaux/psobjs.c\n  (bsc#1036457)\n- Fix several integer overflow issues in truetype/ttinterp.c (bsc#1079600)\n","status":"published","published":"2018-02-09T15:49:39Z","modified":"2026-02-04T02:56:10.46185Z","updated_at":"2026-11-02T15:53:44.594517Z"}]}}