TI-2014-07846 Aliases CVE-2014-9656 GHSA-2rqp-7mg5-p5j7

The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType before 2.5.4 does…

MEDIUM 40CWE-119Published 2015-02-08 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: Partial · Partial · Partial
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType before 2.5.4 does not properly check for an integer overflow, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted OpenType font.

Why it matters now

EPSS 0.04578 91st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPE	Versions	Role	Vendor
cpe:2.3:o:fedoraproject:fedora:20:::::::*	20	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:21:::::::*	21	Vulnerable	Fedoraproject
cpe:2.3:a:freetype:freetype::::::::	up to 2.5.3	Vulnerable	FreeType
cpe:2.3:o:debian:debian_linux:7.0:::::::*	7.0	Vulnerable	Debian
cpe:2.3:o:opensuse:opensuse:13.1:::::::*	13.1	Vulnerable	openSUSE
cpe:2.3:o:opensuse:opensuse:13.2:::::::*	13.2	Vulnerable	openSUSE
cpe:2.3:o:canonical:ubuntu_linux:10.04::::lts:::	10.04	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:12.04::::lts:::	12.04	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::	14.04	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:14.10:::::::*	14.10	Vulnerable	Canonical

cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:* Versions 20 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:* Versions 21 Vulnerable ·Fedoraproject
cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:* Versions up to 2.5.3 Vulnerable ·FreeType
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Debian
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:* Versions 13.1 Vulnerable ·openSUSE
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* Versions 13.2 Vulnerable ·openSUSE
cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:* Versions 10.04 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:* Versions 12.04 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:* Versions 14.10 Vulnerable ·Canonical

Show 1 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:canonical:ubuntu_linux:15.04:::::::*	15.04	Vulnerable	Canonical

cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:* Versions 15.04 Vulnerable ·Canonical

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 5 products

Red Hat Enterprise Linux 4
Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Virtualization 3

Timeline

2026-10-02 Threatist record created from CVE-2014-9656
2026-10-03 Alias added: GHSA-2rqp-7mg5-p5j7

References

Exploit 1

http://code.google.com/p/google-security-research/issues/detail?id=196

Advisory 10

Other 1

http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=f0292bb9920aa1dbfed5f53861e7c7a89b35833a

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences