CVE-2025-23022 - Vulnerability Details - OpenCVE

FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://gitlab.freedesktop.org/freetype/freetype/-/issues/1312
https://nvd.nist.gov/vuln/detail/CVE-2025-23022
https://security-tracker.debian.org/tracker/CVE-2025-23022
https://www.cve.org/CVERecord?id=CVE-2025-23022

History

Mon, 13 Jan 2025 21:00:00 +0000

Type	Values Removed	Values Added
References		https://security-tracker.debian.org/tracker/CVE-2025-23022

Sat, 11 Jan 2025 02:00:00 +0000

Type	Values Removed	Values Added
Title		freetype: signed integer overflow in cf2_doFlex
References		https://nvd.nist.gov/vuln/detail/CVE-2025-23022 https://www.cve.org/CVERecord?id=CVE-2025-23022
Metrics	threat_severity `None`	threat_severity `Moderate`

Fri, 10 Jan 2025 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-190
Metrics		cvssV3_1 `{'score': 4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}`

Fri, 10 Jan 2025 15:15:00 +0000

Type	Values Removed	Values Added
Description		FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.
References		https://gitlab.freedesktop.org/freetype/freetype/-/issues/1312

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2025-01-10T00:00:00

Updated: 2025-01-13T20:49:06.014029Z

Reserved: 2025-01-10T00:00:00

Link: CVE-2025-23022

Vulnrichment

No data.

NVD

Status : Undergoing Analysis

Published: 2025-01-10T15:15:16.967

Modified: 2025-01-13T21:15:15.753

Link: CVE-2025-23022

Redhat

Severity : Moderate

Publid Date: 2025-01-10T00:00:00Z

Links: CVE-2025-23022 - Bugzilla

{"bugzilla": {"description": "freetype: signed integer overflow in cf2_doFlex", "id": "2336955", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2336955"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.", "A flaw was found in FreeType. In certain versions, specially crafted input may trigger an integer overflow condition. This issue can cause an application crash, leading to a denial of service."], "name": "CVE-2025-23022", "package_state": [{"cpe": "cpe:/a:redhat:openjdk:11", "fix_state": "Not affected", "package_name": "java-11-openjdk-portable", "product_name": "Red Hat build of OpenJDK 11"}, {"cpe": "cpe:/a:redhat:openjdk:17", "fix_state": "Not affected", "package_name": "java-17-openjdk-portable", "product_name": "Red Hat build of OpenJDK 17"}, {"cpe": "cpe:/a:redhat:openjdk:21", "fix_state": "Not affected", "package_name": "java-21-openjdk-portable-rhel7", "product_name": "Red Hat build of OpenJDK 21"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "freetype", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "freetype", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "freetype", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "java-17-openjdk", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "java-21-openjdk", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "mingw-freetype", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "freetype", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "java-17-openjdk", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "java-21-openjdk", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2025-01-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-23022\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-23022\nhttps://gitlab.freedesktop.org/freetype/freetype/-/issues/1312"], "statement": "No Red Hat products ship an affected version of FreeType.", "threat_severity": "Moderate"}