TI-2014-07862 Aliases CVE-2014-9672 GHSA-58fh-qf9x-f6j9

Array index error in the parse_fond function in base/ftmac.c in FreeType before 2.5.4…

LOW 34CWE-119Published 2015-02-08 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: —
Confidentiality · integrity · availability: Partial · None · Partial
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Array index error in the parse_fond function in base/ftmac.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information from process memory via a crafted FOND resource in a Mac font file.

Why it matters now

EPSS 0.04684 91st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPE	Versions	Role	Vendor
cpe:2.3:o:oracle:solaris:10.0:::::::*	10.0	Vulnerable	Oracle
cpe:2.3:o:oracle:solaris:11.2:::::::*	11.2	Vulnerable	Oracle
cpe:2.3:o:debian:debian_linux:7.0:::::::*	7.0	Vulnerable	Debian
cpe:2.3:o:canonical:ubuntu_linux:10.04::::lts:::	10.04	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:12.04::::lts:::	12.04	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::	14.04	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:14.10:::::::*	14.10	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:15.04:::::::*	15.04	Vulnerable	Canonical
cpe:2.3:a:freetype:freetype::::::::	up to 2.5.3	Vulnerable	FreeType
cpe:2.3:o:opensuse:opensuse:13.1:::::::*	13.1	Vulnerable	openSUSE

cpe:2.3:o:oracle:solaris:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Oracle
cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:* Versions 11.2 Vulnerable ·Oracle
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Debian
cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:* Versions 10.04 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:* Versions 12.04 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:* Versions 14.10 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:* Versions 15.04 Vulnerable ·Canonical
cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:* Versions up to 2.5.3 Vulnerable ·FreeType
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:* Versions 13.1 Vulnerable ·openSUSE

Show 1 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:opensuse:opensuse:13.2:::::::*	13.2	Vulnerable	openSUSE

cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* Versions 13.2 Vulnerable ·openSUSE

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 5 products

Red Hat Enterprise Linux 4
Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Virtualization 3

Timeline

2026-10-02 Threatist record created from CVE-2014-9672
2026-10-03 Alias added: GHSA-58fh-qf9x-f6j9

References

Exploit 1

http://code.google.com/p/google-security-research/issues/detail?id=155

Patch 1

http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=18a8f0d9943369449bc4de92d411c78fb08d616c

Advisory 8

Other 1

http://packetstormsecurity.com/files/134395/FreeType-2.5.3-Mac-FOND-Resource-Parsing-Out-Of-Bounds-Read-From-Stack.html

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences