Freetype vulnerabilities

Products

• Freetype 95

Newest

• freetype An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in... CVE-2026-23865 Fix available 5.3 MediumMarch 2, 2026
• freetype, debian linux +1 more An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font... CVE-2025-27363 In KEVPublic exploitFix available EPSS 27.8% 8.1 HighMarch 11, 2025
• freetype FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c. CVE-2025-23022 Fix available 4.0 MediumJanuary 10, 2025
• freetype, fedoraproject fedora +1 more FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation... CVE-2022-27406 Fix available 7.5 HighApril 22, 2022
• freetype, fedoraproject fedora +1 more FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation... CVE-2022-27405 Fix available 7.5 HighApril 22, 2022
• freetype, fedoraproject fedora +1 more FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer... CVE-2022-27404 Fix available 9.8 CriticalApril 22, 2022
• freetype, google chrome, debian linux +4 more +6 more Heap buffer overflow in CefSharp CVE-2020-15999 In KEVPublic exploitFix available EPSS 63.9% 9.6 CriticalOctober 20, 2020
• freetype, canonical ubuntu linux, debian linux +2 more FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c. CVE-2015-9383 Fix available 6.5 MediumSeptember 3, 2019
• freetype, debian linux +1 more FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because... CVE-2015-9382 Fix available 6.5 MediumSeptember 3, 2019
• freetype, debian linux +1 more FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c. CVE-2015-9381 Fix available 8.8 HighSeptember 3, 2019
• freetype In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function... CVE-2015-9290 Fix available 9.8 CriticalJuly 30, 2019
• freetype, canonical ubuntu linux +1 more An issue was discovered in FreeType 2 through 2.9. A NULL pointer dereference in the... CVE-2018-6942 Fix available 6.5 MediumFebruary 13, 2018
• freetype FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow... CVE-2017-8287 Fix available 9.8 CriticalApril 26, 2017
• freetype, debian linux +1 more FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow... CVE-2017-8105 Fix available 9.8 CriticalApril 24, 2017
• freetype FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow... CVE-2017-7864 Fix available 9.8 CriticalApril 14, 2017
• freetype FreeType 2 before 2017-03-07 has an out-of-bounds write related to the TT_Get_MM_Var function in... CVE-2017-7858 9.8 CriticalApril 14, 2017
• freetype FreeType 2 before 2017-03-08 has an out-of-bounds write caused by a heap-based buffer overflow... CVE-2017-7857 9.8 CriticalApril 14, 2017
• freetype, oracle outside in technology +1 more FreeType 2 before 2016-12-16 has an out-of-bounds write caused by a heap-based buffer overflow... CVE-2016-10328 Fix available 9.8 CriticalApril 14, 2017
• freetype, debian linux +1 more The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a... CVE-2016-10244 Fix available 7.8 HighMarch 6, 2017
• freetype, debian linux +1 more The t42_parse_encoding function in type42/t42parse.c in FreeType before 2.5.4 does not properly... CVE-2014-9747 Fix available 7.5 HighSeptember 29, 2015
• freetype, debian linux +1 more The (1) t1_parse_font_matrix function in type1/t1load.c, (2) cid_parse_font_matrix function in... CVE-2014-9746 Fix available 9.8 CriticalSeptember 29, 2015
• freetype, canonical ubuntu linux, debian linux +1 more +3 more The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to... CVE-2014-9745 Fix available 5.0 MediumSeptember 10, 2015
• freetype, canonical ubuntu linux, debian linux +8 more +10 more bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial... CVE-2014-9675 Fix available 5.0 MediumFebruary 8, 2015
• freetype, canonical ubuntu linux, fedoraproject fedora +8 more +10 more The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with... CVE-2014-9674 Fix available 7.5 HighFebruary 8, 2015
• freetype, canonical ubuntu linux, debian linux +7 more +9 more Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType... CVE-2014-9673 Fix available 6.8 MediumFebruary 8, 2015
• freetype, canonical ubuntu linux, debian linux +2 more +4 more Array index error in the parse_fond function in base/ftmac.c in FreeType before 2.5.4 allows... CVE-2014-9672 Fix available 5.8 MediumFebruary 8, 2015
• freetype, canonical ubuntu linux, debian linux +8 more +10 more Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4... CVE-2014-9671 Fix available 4.3 MediumFebruary 8, 2015
• freetype, canonical ubuntu linux, debian linux +9 more +11 more Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType... CVE-2014-9670 Fix available 4.3 MediumFebruary 8, 2015
• freetype, canonical ubuntu linux, debian linux +9 more +11 more Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to... CVE-2014-9669 Fix available 6.8 MediumFebruary 8, 2015
• freetype, canonical ubuntu linux, fedoraproject fedora +1 more +3 more The woff_open_font function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds with offset+length... CVE-2014-9668 Fix available 7.5 HighFebruary 8, 2015
• freetype, canonical ubuntu linux, debian linux +8 more +10 more sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without... CVE-2014-9667 Fix available 6.8 MediumFebruary 8, 2015
• freetype, canonical ubuntu linux, debian linux +9 more +11 more The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count... CVE-2014-9666 Fix available 6.8 MediumFebruary 8, 2015
• freetype, canonical ubuntu linux, fedoraproject fedora +1 more +3 more The Load_SBit_Png function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows... CVE-2014-9665 Fix available 7.5 HighFebruary 8, 2015
• freetype, canonical ubuntu linux, debian linux +9 more +11 more FreeType before 2.5.4 does not check for the end of the data during certain parsing actions,... CVE-2014-9664 Fix available 6.8 MediumFebruary 8, 2015
• freetype, canonical ubuntu linux, debian linux +9 more +11 more The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain... CVE-2014-9663 Fix available 7.5 HighFebruary 8, 2015
• freetype, canonical ubuntu linux, debian linux +2 more +4 more cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation... CVE-2014-9662 Fix available 7.5 HighFebruary 8, 2015
• freetype, canonical ubuntu linux, debian linux +8 more +10 more type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete... CVE-2014-9661 Fix available 7.5 HighFebruary 8, 2015
• freetype, canonical ubuntu linux, debian linux +9 more +11 more The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle... CVE-2014-9660 Fix available 7.5 HighFebruary 8, 2015
• freetype, canonical ubuntu linux, fedoraproject fedora +2 more +4 more cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with... CVE-2014-9659 Fix available 7.5 HighFebruary 8, 2015
• freetype, canonical ubuntu linux, debian linux +9 more +11 more The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect... CVE-2014-9658 Fix available 7.5 HighFebruary 8, 2015
• freetype, canonical ubuntu linux, debian linux +9 more +11 more The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish... CVE-2014-9657 Fix available 7.5 HighFebruary 8, 2015
• freetype, canonical ubuntu linux, debian linux +2 more +4 more The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType before 2.5.4 does not... CVE-2014-9656 Fix available 7.5 HighFebruary 8, 2015
• freetype, canonical ubuntu linux +1 more The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in... CVE-2014-2241 Fix available 6.8 MediumMarch 15, 2014
• freetype Stack-based buffer overflow in the cf2_hintmap_build function in cff/cf2hints.c in FreeType... CVE-2014-2240 Fix available 7.5 HighMarch 12, 2014
• freetype The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to... CVE-2012-5670 Fix available 4.3 MediumJanuary 24, 2013
• freetype The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to... CVE-2012-5669 Fix available 4.3 MediumJanuary 24, 2013
• freetype FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (NULL... CVE-2012-5668 Fix available 4.3 MediumJanuary 24, 2013
• freetype, mozilla firefox mobile +1 more FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows... CVE-2012-1143 Fix available 4.3 MediumApril 25, 2012
• freetype, mozilla firefox mobile +1 more FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows... CVE-2012-1141 Fix available 9.3 HighApril 25, 2012
• freetype, mozilla firefox mobile +1 more FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows... CVE-2012-1140 Fix available 9.3 HighApril 25, 2012
• Show olderLoading…