fkie_cve-2010-3814
Vulnerability from fkie_nvd
Published
2010-11-26 20:00
Modified
2025-04-11 00:51
Severity ?
Summary
Heap-based buffer overflow in the Ins_SHZ function in ttinterp.c in FreeType 2.4.3 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted SHZ bytecode instruction, related to TrueType opcodes, as demonstrated by a PDF document with a crafted embedded font.
References
product-security@apple.comhttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=602221
product-security@apple.comhttp://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0edf0986f3be570f5bf90ff245a85c1675f5c9a4
product-security@apple.comhttp://lists.apple.com/archives/security-announce/2010//Nov/msg00003.htmlVendor Advisory
product-security@apple.comhttp://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
product-security@apple.comhttp://secunia.com/advisories/42314
product-security@apple.comhttp://secunia.com/advisories/43138
product-security@apple.comhttp://secunia.com/advisories/48951
product-security@apple.comhttp://security-tracker.debian.org/tracker/CVE-2010-3814
product-security@apple.comhttp://support.apple.com/kb/HT4456Vendor Advisory
product-security@apple.comhttp://support.apple.com/kb/HT4581
product-security@apple.comhttp://www.debian.org/security/2011/dsa-2155
product-security@apple.comhttp://www.mandriva.com/security/advisories?name=MDVSA-2010:236
product-security@apple.comhttp://www.securityfocus.com/bid/44643
product-security@apple.comhttp://www.securitytracker.com/id?1024767
product-security@apple.comhttp://www.ubuntu.com/usn/USN-1013-1
product-security@apple.comhttp://www.vupen.com/english/advisories/2010/3046
product-security@apple.comhttp://www.vupen.com/english/advisories/2011/0246
af854a3a-2127-422b-91ae-364da2661108http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=602221
af854a3a-2127-422b-91ae-364da2661108http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0edf0986f3be570f5bf90ff245a85c1675f5c9a4
af854a3a-2127-422b-91ae-364da2661108http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/42314
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/43138
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/48951
af854a3a-2127-422b-91ae-364da2661108http://security-tracker.debian.org/tracker/CVE-2010-3814
af854a3a-2127-422b-91ae-364da2661108http://support.apple.com/kb/HT4456Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://support.apple.com/kb/HT4581
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2011/dsa-2155
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2010:236
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/44643
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1024767
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-1013-1
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2010/3046
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2011/0246
Impacted products
Vendor Product Version
freetype freetype *
freetype freetype 1.3.1
freetype freetype 2.0.6
freetype freetype 2.0.9
freetype freetype 2.1
freetype freetype 2.1.3
freetype freetype 2.1.4
freetype freetype 2.1.5
freetype freetype 2.1.6
freetype freetype 2.1.7
freetype freetype 2.1.8
freetype freetype 2.1.8
freetype freetype 2.1.9
freetype freetype 2.1.10
freetype freetype 2.2.0
freetype freetype 2.2.1
freetype freetype 2.2.10
freetype freetype 2.3.0
freetype freetype 2.3.1
freetype freetype 2.3.2
freetype freetype 2.3.3
freetype freetype 2.3.4
freetype freetype 2.3.5
freetype freetype 2.3.6
freetype freetype 2.3.7
freetype freetype 2.3.8
freetype freetype 2.3.9
freetype freetype 2.3.10
freetype freetype 2.3.11
freetype freetype 2.3.12
freetype freetype 2.4.0
freetype freetype 2.4.1
freetype freetype 2.4.2


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "221E5B57-16B2-4FB7-A469-1914D9E3F35E",
              "versionEndIncluding": "2.4.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:1.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "888C3BB8-510B-4FBE-BA5D-0D488583C7DD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "B126D1A0-6B54-4C56-8CEC-B395D54A5C3C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "28CA4C7D-D70A-44CF-8E3D-F2612CCA0799",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "D4E76672-7216-443E-BBD8-120DA96F7E4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "369D87D8-E4A7-4EC4-B508-2940EE174F95",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "288FDB59-7FE4-4351-8822-554ADF07C79A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "B681257A-F8D8-46D5-995D-BC44F54DD5C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "56E0DEB6-4414-49AB-88E9-988CE5D8EF67",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "56A90D08-2CAF-422F-8587-7D88EC7632A1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.1.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "9B944FEB-F69D-4F6C-9485-26F95A5874B6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.1.8:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "B9B9B1DE-89F6-463D-A3F4-6366D5D30077",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.1.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "F73474B9-6853-4C5C-9CB9-5F4D3080D1C5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.1.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "5283E910-D512-481C-804E-8717A83B24CB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "A28C0F7A-F1F3-4F3B-81B9-228DA8FCCCD8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F7252819-BA8A-4BD1-BAAA-179A8777C994",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.2.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B4450B4-B21F-4153-B9DD-C36A2381F00D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "11575E3C-2BEA-4264-AE41-4A962BD17035",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "D333A965-EAD2-40DB-8FBE-C4C7DF44C35C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "8CA37666-D2E6-47EF-BFFE-A9449D6A72CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "F2B49505-C973-4673-A9BC-34ACA25059D0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.3.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8E8ECCA-58F2-4A05-8DF2-79C09A5FB275",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.3.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "8697D11D-BBDF-4722-85F7-5144A5D26E37",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.3.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "50E3EDA8-04D1-4DF1-80BB-72C6003E8F53",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.3.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "AB06CA25-BB25-43B8-9FC2-62C399CC52EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.3.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "6AF7414E-33A7-40E2-AEF0-1AE9D7D1B077",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.3.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "6FC0BD12-E065-4CC9-8AEE-E4C34A58EC3C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.3.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "214DC64B-BA35-486B-AE30-F2D9381E4D26",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.3.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "B7CDE19A-473A-4BC5-AA7B-3D08FEEEE82C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.3.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD8401A8-A328-49F6-BAE8-337F5F36C906",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3FBF5BAA-8027-478F-BE06-3D3F4F823C7B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "31358B5D-4087-4207-9730-297BA47DAA83",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:freetype:freetype:2.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A73E016-A4B0-416D-B9B6-786A787DAD3D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in the Ins_SHZ function in ttinterp.c in FreeType 2.4.3 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted SHZ bytecode instruction, related to TrueType opcodes, as demonstrated by a PDF document with a crafted embedded font."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de b\u00fafer basado en memoria din\u00e1mica en la funci\u00f3n Ins_SHZ en ttinterp.c en FreeType v2.4.3 y anteriores permite a atacantes remotos ejecutar c\u00f3digo a su o elecci\u00f3n y causar una denegaci\u00f3n de servicio (cuelgue de aplicaci\u00f3n) a trav\u00e9s de una instrucci\u00f3n SHZ bytecode manipulada, relacionados con opcodes TrueType, como lo demuestra un documento PDF con una fuente manipulada incrustada."
    }
  ],
  "id": "CVE-2010-3814",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2010-11-26T20:00:02.923",
  "references": [
    {
      "source": "product-security@apple.com",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=602221"
    },
    {
      "source": "product-security@apple.com",
      "url": "http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0edf0986f3be570f5bf90ff245a85c1675f5c9a4"
    },
    {
      "source": "product-security@apple.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html"
    },
    {
      "source": "product-security@apple.com",
      "url": "http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html"
    },
    {
      "source": "product-security@apple.com",
      "url": "http://secunia.com/advisories/42314"
    },
    {
      "source": "product-security@apple.com",
      "url": "http://secunia.com/advisories/43138"
    },
    {
      "source": "product-security@apple.com",
      "url": "http://secunia.com/advisories/48951"
    },
    {
      "source": "product-security@apple.com",
      "url": "http://security-tracker.debian.org/tracker/CVE-2010-3814"
    },
    {
      "source": "product-security@apple.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://support.apple.com/kb/HT4456"
    },
    {
      "source": "product-security@apple.com",
      "url": "http://support.apple.com/kb/HT4581"
    },
    {
      "source": "product-security@apple.com",
      "url": "http://www.debian.org/security/2011/dsa-2155"
    },
    {
      "source": "product-security@apple.com",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:236"
    },
    {
      "source": "product-security@apple.com",
      "url": "http://www.securityfocus.com/bid/44643"
    },
    {
      "source": "product-security@apple.com",
      "url": "http://www.securitytracker.com/id?1024767"
    },
    {
      "source": "product-security@apple.com",
      "url": "http://www.ubuntu.com/usn/USN-1013-1"
    },
    {
      "source": "product-security@apple.com",
      "url": "http://www.vupen.com/english/advisories/2010/3046"
    },
    {
      "source": "product-security@apple.com",
      "url": "http://www.vupen.com/english/advisories/2011/0246"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=602221"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0edf0986f3be570f5bf90ff245a85c1675f5c9a4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/42314"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/43138"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/48951"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security-tracker.debian.org/tracker/CVE-2010-3814"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://support.apple.com/kb/HT4456"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://support.apple.com/kb/HT4581"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2011/dsa-2155"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:236"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/44643"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1024767"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-1013-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2010/3046"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2011/0246"
    }
  ],
  "sourceIdentifier": "product-security@apple.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.