{"id":"CVE-2023-2004","aliases":["EUVD-2023-33534","GHSA-pxwf-m68q-gmw8","MGASA-2023-0182","OESA-2023-1246","SUSE-SU-2023:3461-1","UBUNTU-CVE-2023-2004","USN-6062-1"],"status":"rejected","title":"An integer overflow vulnerability was discovered in Freetype in tt_hvadvance_adjust() function in...","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2023-04-14T20:49:26Z","modified":"2026-08-18T01:17:40Z","fixes":[{"ecosystem":"Mageia:8","package":"freetype2","fixed_in":["2.10.4-2.3.mga8","2.10.4-2.3.mga8.tainted"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"freetype","fixed_in":["2.10.2-5.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"freetype","fixed_in":["2.10.2-5.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"freetype","fixed_in":["2.12.1-2.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"freetype","fixed_in":["2.12.1-2.oe2203sp1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"freetype2","fixed_in":["2.10.4-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"freetype2","fixed_in":["2.10.4-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"freetype2","fixed_in":["2.10.4-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"freetype2","fixed_in":["2.10.4-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"ft2demos","fixed_in":["2.10.4-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"ft2demos","fixed_in":["2.10.4-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.2","package":"freetype2","fixed_in":["2.10.4-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.2","package":"freetype2","fixed_in":["2.10.4-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"freetype2","fixed_in":["2.10.4-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"freetype2","fixed_in":["2.10.4-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"freetype2","fixed_in":["2.10.4-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.4","package":"freetype2","fixed_in":["2.10.4-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"freetype2","fixed_in":["2.10.4-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"ft2demos","fixed_in":["2.10.4-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"freetype2","fixed_in":["2.10.4-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"ft2demos","fixed_in":["2.10.4-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"freetype","fixed_in":["2.10.1-2ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"freetype","fixed_in":["2.11.1+dfsg-1ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:8","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4-2.3.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4-2.3.mga8.tainted"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.2-5.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.2-5.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.1-2.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.1-2.oe2203sp1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"ft2demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"ft2demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"ft2demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"freetype2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"ft2demos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-2ubuntu0.3"}]}],"versions":["2.9.1-4","2.10.1-2","2.10.1-2ubuntu0.1","2.10.1-2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1+dfsg-1ubuntu0.2"}]}],"versions":["2.10.4+dfsg-1build1","2.10.4+dfsg-1build2","2.11.0+dfsg-1","2.11.1+dfsg-1","2.11.1+dfsg-1build1","2.11.1+dfsg-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-2ubuntu0.3"}]}],"versions":["2.9.1-4","2.10.1-2","2.10.1-2ubuntu0.1","2.10.1-2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1+dfsg-1ubuntu0.2"}]}],"versions":["2.10.4+dfsg-1build1","2.10.4+dfsg-1build2","2.11.0+dfsg-1","2.11.1+dfsg-1","2.11.1+dfsg-1build1","2.11.1+dfsg-1ubuntu0.1"]}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2004","tags":["advisory"]},{"url":"https://github.com/freetype/freetype/commit/e6fda039ad638866b7a6a5d046f03278ba1b7611"},{"url":"https://access.redhat.com/security/cve/CVE-2023-2004","tags":["report"]},{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50462"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2186428"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NGWWGQULJ7QRNP4GY57HE7OO7VMRWMPN/","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FEJZMAUB4XP44HSHEBDWEKFGA7DUHY42/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4AOSGAOPXLBK4A5ZRTVZ4M6QKVLSWMWG/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJQI63HWZFL6M26Q6UOHKDY6LD2PFC5Z/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KDNGTGQAUZJ6YQDI2AVGYIFFPUMMZLKS/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SFZWDF43D73C5KWFF26GIIVZJKEFPS3K/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VRSEIYMPWLVPGTC34N2Q3WAUHGGOWSWP/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHHD6KNH4WLUE6JG6HRQZWNAJMHJ32X7/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SLO7BL2MHZYPY6O3OAEAQL3SKYMGGO6M/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ES2CDRHR2Y4WY6DNDIAPYZFXJU3ZBFAV/"},{"url":"https://github.com/advisories/GHSA-pxwf-m68q-gmw8"},{"url":"https://advisories.mageia.org/MGASA-2023-0182.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31887","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/KDNGTGQAUZJ6YQDI2AVGYIFFPUMMZLKS/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-6062-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1246","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233461-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210419","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2004","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-2004","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-2004","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-2004","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","published":"2023-04-14T20:49:26.564Z","modified":"2025-02-13T15:46:36.481Z","updated_at":"2026-11-02T14:35:24.360381Z"}],"euvd":[{"id":"EUVD-2023-33534","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"published","published":"2023-04-14T20:49:26Z","modified":"2025-02-13T15:46:36Z","updated_at":"2026-11-03T00:03:55.403392Z"}],"ghsa":[{"id":"GHSA-pxwf-m68q-gmw8","title":"An integer overflow vulnerability was discovered in Freetype in tt_hvadvance_adjust() function in...","description":"An integer overflow vulnerability was discovered in Freetype in tt_hvadvance_adjust() function in src/truetype/ttgxvar.c.","status":"published","published":"2023-04-14T21:30:22Z","modified":"2023-05-02T03:30:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:54:34.500941Z"}],"nvd":[{"id":"CVE-2023-2004","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","published":"2023-04-14T21:15:08.547Z","modified":"2023-11-07T04:11:40.947Z","updated_at":"2026-11-02T14:07:55.652109Z"}],"osv":[{"id":"OESA-2023-1246","title":"freetype security update","description":"FreeType is written in C, designed to be small,efficient, highly customizable, and  portable while capable of producing high-quality output (glyph images) of most vector and bitmap font formats\r\n\r\nSecurity Fix(es):\r\n\r\nAn integer overflow vulnerability was discovered in Freetype in tt_hvadvance_adjust() function in src/truetype/ttgxvar.c.(CVE-2023-2004)","status":"published","published":"2023-04-21T11:05:43Z","modified":"2026-08-18T01:17:40.630742552Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"UBUNTU-CVE-2023-2004","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"published","published":"2023-04-14T21:15:00Z","modified":"2026-04-22T14:00:38.050077Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:18.756095Z"},{"id":"MGASA-2023-0182","title":"Updated freetype2 packages fix security vulnerability","description":"An integer overflow vulnerability was discovered in Freetype in\ntt_hvadvance_adjust() function in src/truetype/ttgxvar.c. (CVE-2023-2004)\n","status":"published","published":"2023-05-21T08:42:44Z","modified":"2026-04-16T04:41:00.21167181Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"SUSE-SU-2023:3461-1","title":"Security update for freetype2","description":"This update for freetype2 fixes the following issues:\n\n- CVE-2023-2004: Fixed integer overflow in tt_hvadvance_adjust (bsc#1210419).\n","status":"published","published":"2023-08-28T15:27:38Z","modified":"2026-02-04T03:11:01.032587Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"USN-6062-1","title":"freetype vulnerability","description":"It was discovered that FreeType incorrectly handled certain malformed\nfont files. If a user were tricked into using a specially crafted font\nfile, a remote attacker could cause FreeType to crash, or possibly execute\narbitrary code.\n","status":"published","published":"2023-05-09T09:30:33Z","modified":"2026-04-22T10:34:55.46399Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}