Vulnerability Name:

CVE-2010-2807 (CCN-61247)

Assigned:2010-08-12
Published:2010-08-12
Updated:2021-04-06
Summary:FreeType before 2.4.2 uses incorrect integer data types during bounds checking, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-681
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2010-2807

Source: CONFIRM
Type: Release Notes, Third Party Advisory
http://freetype.sourceforge.net/index2.html#release-freetype-2.4.2

Source: CONFIRM
Type: Patch, Third Party Advisory
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=346f1867fd32dae8f56e5b482d1af98f626804ac

Source: APPLE
Type: Mailing List, Third Party Advisory
APPLE-SA-2010-11-10-1

Source: APPLE
Type: Mailing List, Third Party Advisory
APPLE-SA-2010-11-22-1

Source: MLIST
Type: Mailing List, Patch, Third Party Advisory
[oss-security] 20100806 Re: CVE Request -- FreeType -- Memory corruption flaw by processing certain LWFN fonts + three more

Source: CCN
Type: SA40816
FreeType2 CFF Font Parsing Vulnerabilities

Source: SECUNIA
Type: Third Party Advisory
40816

Source: SECUNIA
Type: Third Party Advisory
40982

Source: CCN
Type: SA42314
Apple iOS Multiple Vulnerabilities

Source: SECUNIA
Type: Third Party Advisory
42314

Source: CCN
Type: SA42317
Apple TV Multiple Vulnerabilities

Source: SECUNIA
Type: Third Party Advisory
42317

Source: CONFIRM
Type: Product, Third Party Advisory
http://sourceforge.net/projects/freetype/files/freetype2/2.4.2/NEWS/view

Source: CONFIRM
Type: Broken Link
http://support.apple.com/kb/HT4435

Source: CCN
Type: Apple Web site
About the security content of iOS 4.2

Source: CONFIRM
Type: Third Party Advisory
http://support.apple.com/kb/HT4456

Source: CONFIRM
Type: Third Party Advisory
http://support.apple.com/kb/HT4457

Source: DEBIAN
Type: DSA-2105
freetype -- several vulnerabilities

Source: CCN
Type: FreeType Web site
FreeType

Source: CCN
Type: OSVDB ID: 67304
FreeType Bounds Checking Integer Data Type Crafted Font File DoS

Source: BID
Type: Third Party Advisory, VDB Entry
42285

Source: CCN
Type: BID-42285
FreeType Stack Buffer Overflow and Memory Corruption Vulnerabilities

Source: UBUNTU
Type: Third Party Advisory
USN-972-1

Source: VUPEN
Type: Third Party Advisory
ADV-2010-2018

Source: VUPEN
Type: Third Party Advisory
ADV-2010-2106

Source: VUPEN
Type: Third Party Advisory
ADV-2010-3045

Source: VUPEN
Type: Third Party Advisory
ADV-2010-3046

Source: CCN
Type: Bug #617019
FreeType security fixes in 2.4.2

Source: CONFIRM
Type: Issue Tracking, Release Notes, Third Party Advisory
https://bugs.launchpad.net/ubuntu/maverick/+source/freetype/+bug/617019

Source: XF
Type: UNKNOWN
freetype-font-code-execution(61247)

Source: CONFIRM
Type: Issue Tracking, Third Party Advisory
https://savannah.nongnu.org/bugs/?30657

Source: SUSE
Type: SUSE-SR:2010:016
SUSE Security Summary Report

Vulnerable Configuration:Configuration 1:
  • cpe:/a:freetype:freetype:*:*:*:*:*:*:*:* (Version < 2.4.2)

    • Configuration 2:
  • cpe:/o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*

    • Configuration 3:
  • cpe:/o:apple:iphone_os:*:*:*:*:*:*:*:* (Version < 4.2)
  • OR cpe:/o:apple:mac_os_x:*:*:*:*:*:*:*:* (Version < 10.6.5)
  • OR cpe:/o:apple:tvos:*:*:*:*:*:*:*:* (Version < 4.1.0)

    • Configuration CCN 1:
  • cpe:/a:freetype:freetype:2.3.3:*:*:*:*:*:*:*
  • OR cpe:/o:apple:iphone_os:2.0.0:-:ipodtouch:*:*:*:*:*
  • OR cpe:/o:apple:iphone_os:2.0.1:*:*:*:*:*:*:*
  • OR cpe:/o:apple:iphone_os:2.0.1:-:ipodtouch:*:*:*:*:*
  • OR cpe:/o:apple:iphone_os:2.0.2:*:*:*:*:*:*:*
  • OR cpe:/o:apple:iphone_os:2.0.2:-:ipodtouch:*:*:*:*:*
  • OR cpe:/a:freetype:freetype:2.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:freetype:freetype:2.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:freetype:freetype:2.1:*:*:*:*:*:*:*
  • OR cpe:/a:freetype:freetype:2.1.10:*:*:*:*:*:*:*
  • OR cpe:/a:freetype:freetype:2.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:freetype:freetype:2.1.4:-:*:*:*:*:*:*
  • OR cpe:/a:freetype:freetype:2.1.5:-:*:*:*:*:*:*
  • OR cpe:/a:freetype:freetype:2.2.0:-:*:*:*:*:*:*
  • OR cpe:/a:freetype:freetype:2.1.9:*:*:*:*:*:*:*
  • OR cpe:/a:freetype:freetype:2.3.4:*:*:*:*:*:*:*
  • OR cpe:/a:freetype:freetype:2.1.7:*:*:*:*:*:*:*
  • OR cpe:/a:freetype:freetype:2.1.6:*:*:*:*:*:*:*
  • OR cpe:/a:freetype:freetype:2.1.8:rc1:*:*:*:*:*:*
  • OR cpe:/a:freetype:freetype:2.1.8:-:*:*:*:*:*:*
  • OR cpe:/a:freetype:freetype:2.2.10:*:*:*:*:*:*:*
  • OR cpe:/a:freetype:freetype:2.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:freetype:freetype:2.3.5:*:*:*:*:*:*:*
  • OR cpe:/a:freetype:freetype:2.3.9:*:*:*:*:*:*:*
  • OR cpe:/o:apple:iphone_os:2.1:*:*:*:*:*:*:*
  • OR cpe:/o:apple:iphone_os:2.0:*:*:*:*:*:*:*
  • OR cpe:/o:apple:iphone_os:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:apple:iphone_os:3.1:*:*:*:*:*:*:*
  • OR cpe:/o:apple:iphone_os:3.1.2:*:*:*:*:*:*:*
  • OR cpe:/o:apple:iphone_os:3.1.3:*:*:*:*:*:*:*
  • OR cpe:/o:apple:ios:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:apple:ios:4.0.1:*:*:*:*:*:*:*
  • OR cpe:/o:apple:iphone_os:2.1:-:ipodtouch:*:*:*:*:*
  • OR cpe:/o:apple:iphone_os:3.0:-:ipodtouch:*:*:*:*:*
  • OR cpe:/o:apple:iphone_os:3.1.2:-:ipodtouch:*:*:*:*:*
  • OR cpe:/o:apple:iphone_os:3.1:-:ipodtouch:*:*:*:*:*
  • OR cpe:/o:apple:ios:4.0.1:-:ipodtouch:*:*:*:*:*
  • OR cpe:/o:apple:ios:4.0:-:ipodtouch:*:*:*:*:*
  • AND
  • cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:x86_64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:x86-64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandriva:linux:2009.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandriva:linux:2009.0:-:x86_64:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:5.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandriva:linux:2009.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandriva:linux:2009.1:*:*:*:x86_64:*:*:*
  • OR cpe:/h:apple:ipad:*:*:*:*:*:*:*:*
  • OR cpe:/o:mandriva:enterprise_server:5:*:*:*:*:*:*:*
  • OR cpe:/o:mandriva:enterprise_server:5:*:*:*:x86_64:*:*:*
  • OR cpe:/o:mandriva:linux:2010:*:*:*:x86_64:*:*:*
  • OR cpe:/o:mandriva:linux:2010:*:*:*:*:*:*:*
  • OR cpe:/o:apple:tvos:4.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20102807
    V
    		CVE-2010-2807
    2022-05-20
    oval:org.mitre.oval:def:13149
    P
    		USN-972-1 -- freetype vulnerabilities
    2014-06-30
    oval:org.mitre.oval:def:12761
    P
    		DSA-2105-1 freetype -- several
    2014-06-23
    oval:org.debian:def:2105
    V
    		several vulnerabilities
    2010-09-07
    BACK
    freetype freetype *
    canonical ubuntu linux 6.06
    canonical ubuntu linux 8.04
    canonical ubuntu linux 9.04
    canonical ubuntu linux 9.10
    canonical ubuntu linux 10.04
    apple iphone os *
    apple mac os x *
    apple tvos *
    freetype freetype 2.3.3
    apple iphone os 2.0.0 -
    apple iphone os 2.0.1
    apple iphone os 2.0.1 -
    apple iphone os 2.0.2
    apple iphone os 2.0.2 -
    freetype freetype 2.0.6
    freetype freetype 2.0.9
    freetype freetype 2.1
    freetype freetype 2.1.10
    freetype freetype 2.1.3
    freetype freetype 2.1.4
    freetype freetype 2.1.5
    freetype freetype 2.2
    freetype freetype 2.1.9
    freetype freetype 2.3.4
    freetype freetype 2.1.7
    freetype freetype 2.1.6
    freetype freetype 2.1.8 rc1
    freetype freetype 2.1.8
    freetype freetype 2.2.10
    freetype freetype 2.2.1
    freetype freetype 2.3.5
    freetype freetype 2.3.9
    apple iphone os 2.1
    apple iphone os 2.0
    apple iphone os 3.0
    apple iphone os 3.1
    apple iphone os 3.1.2
    apple iphone os 3.1.3
    apple iphone os 4.0
    apple iphone os 4.0.1
    apple iphone os 2.1 -
    apple iphone os 3.0 -
    apple iphone os 3.1.2 -
    apple iphone os 3.1 -
    apple iphone os 4.0.1 -
    apple iphone os 4.0 -
    mandrakesoft mandrake linux corporate server 4.0
    mandrakesoft mandrake linux corporate server 4.0
    mandrakesoft mandrake linux 2008.0
    mandrakesoft mandrake linux 2008.0
    mandriva linux 2009.0
    mandriva linux 2009.0 -
    debian debian linux 5.0
    mandriva linux 2009.1
    mandriva linux 2009.1
    apple ipad *
    mandriva enterprise server 5
    mandriva enterprise server 5
    mandriva linux 2010
    mandriva linux 2010
    apple apple tv 4.0