FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via crafted glyph or bitmap data in a BDF font that lacks an ENCODING field.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.04956.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
n/a n/a affected
Version Status Constraints
n/a affected —

Configuration 1 [-]

OR cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.0.2:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.0.3:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.0.4:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.0.5:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.0.6:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.0.7:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.0.8:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.0.9:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.1:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.1.3:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.1.4:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.1.5:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.1.6:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.1.7:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.1.8:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.1.8:rc1:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.1.9:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.1.10:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.2.0:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.2.1:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.0:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.1:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.2:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.3:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.4:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.5:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.6:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.7:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.8:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.9:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.10:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.11:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.12:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.4.0:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.4.1:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.4.2:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.4.3:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.4.4:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.4.5:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.4.6:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.4.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_mobile:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_mobile:1.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_mobile:4.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_mobile:4.0:beta1:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_mobile:4.0:beta2:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_mobile:4.0:beta3:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_mobile:4.0:beta4:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_mobile:5.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_mobile:6.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_mobile:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_mobile:6.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_mobile:7.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_mobile:8.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_mobile:9.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_mobile:10.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_mobile:10.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_mobile:10.0.2:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 5
freetype-0:2.2.1-31.el5_8.1 cpe:/o:redhat:enterprise_linux:5 RHSA-2012:0467 2012-04-10T00:00:00Z
Red Hat Enterprise Linux 6
freetype-0:2.3.11-6.el6_2.9 cpe:/o:redhat:enterprise_linux:6 RHSA-2012:0467 2012-04-10T00:00:00Z

No data.

Project Subscriptions

Vendors Products
Freetype Subscribe
Freetype Subscribe
Mozilla Subscribe
Firefox Mobile Subscribe
Redhat Subscribe
Enterprise Linux Subscribe
Advisories
Source ID Title
Debian DSA Debian DSA DSA-2428-1 freetype security update
EUVD EUVD EUVD-2012-1170 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via crafted glyph or bitmap data in a BDF font that lacks an ENCODING field.
Ubuntu USN Ubuntu USN USN-1403-1 FreeType vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00002.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00004.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00015.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2012-0467.html cve-icon cve-icon
http://secunia.com/advisories/48300 cve-icon cve-icon
http://secunia.com/advisories/48508 cve-icon cve-icon
http://secunia.com/advisories/48758 cve-icon cve-icon
http://secunia.com/advisories/48797 cve-icon cve-icon
http://secunia.com/advisories/48822 cve-icon cve-icon
http://secunia.com/advisories/48918 cve-icon cve-icon
http://secunia.com/advisories/48951 cve-icon cve-icon
http://secunia.com/advisories/48973 cve-icon cve-icon
http://security.gentoo.org/glsa/glsa-201204-04.xml cve-icon cve-icon
http://support.apple.com/kb/HT5503 cve-icon cve-icon
http://www.debian.org/security/2012/dsa-2428 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDVSA-2012:057 cve-icon cve-icon
http://www.mozilla.org/security/announce/2012/mfsa2012-21.html cve-icon cve-icon
http://www.openwall.com/lists/oss-security/2012/03/06/16 cve-icon cve-icon
http://www.securityfocus.com/bid/52318 cve-icon cve-icon
http://www.securitytracker.com/id?1026765 cve-icon cve-icon
http://www.ubuntu.com/usn/USN-1403-1 cve-icon cve-icon
https://bugzilla.mozilla.org/show_bug.cgi?id=733512 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=800594 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2012-1136 cve-icon
https://www.cve.org/CVERecord?id=CVE-2012-1136 cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-08-06T18:45:27.474Z

Reserved: 2012-02-14T00:00:00

Link: CVE-2012-1136

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2012-04-25T10:10:18.417

Modified: 2025-04-11T00:51:21.963

Link: CVE-2012-1136

cve-icon Redhat

Severity : Important

Publid Date: 2012-02-27T00:00:00Z

Links: CVE-2012-1136 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses