FR
Vendor
FreeType
95
CVEs
2
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-23865 | FR FreeType FreeType | 5.3 | Mar 2 | An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when… |
| CVE-2025-27363 In wildKEV | FR FreeType FreeType | 8.1 | Mar 11 | FreeType Out-of-Bounds Write Vulnerability |
| CVE-2025-23022 | FR FreeType FreeType | 6.2 | Jan 10 | FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c |
| CVE-2022-27406 | FR Freetype Freetype | 7.5 | Apr 22 | FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size |
| CVE-2022-27405 | FR Freetype Freetype | 7.5 | Apr 22 | FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request |
| CVE-2022-27404 | FR Freetype Freetype | 9.8 | Apr 22 | FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face |
| CVE-2020-15999 In wildKEV | FR Freetype Freetype | 9.6 | Nov 3 | Google Chrome FreeType Heap Buffer Overflow Vulnerability |
| CVE-2015-9383 | FR Freetype Freetype | 6.5 | Sep 3 | FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c |
| CVE-2015-9382 | FR Freetype Freetype | 6.5 | Sep 3 | FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation |
| CVE-2015-9381 | FR Freetype Freetype | 8.8 | Sep 3 | FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c |
| CVE-2015-9290 | FR Freetype Freetype | 9.8 | Jul 30 | In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new values of cur and limit are sensible… |
| CVE-2018-6942 | FR Freetype Freetype | 6.5 | Feb 13 | An issue was discovered in FreeType 2 through 2.9 |
| CVE-2017-8287 | FR Freetype Freetype | 9.8 | Apr 27 | FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c |
| CVE-2017-8105 | FR Freetype Freetype | 9.8 | Apr 24 | FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c |
| CVE-2017-7864 | FR Freetype Freetype | 9.8 | Apr 14 | FreeType 2 before 2017-02-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tt_size_reset function in truetype/ttobjs.c |
| CVE-2017-7858 | FR Freetype Freetype | 9.8 | Apr 14 | FreeType 2 before 2017-03-07 has an out-of-bounds write related to the TT_Get_MM_Var function in truetype/ttgxvar.c and the sfnt_init_face function in sfnt/sfobjs.c |
| CVE-2017-7857 | FR Freetype Freetype | 9.8 | Apr 14 | FreeType 2 before 2017-03-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the TT_Get_MM_Var function in truetype/ttgxvar.c and the sfnt_init_face… |
| CVE-2016-10328 | FR Freetype Freetype | 9.8 | Apr 14 | FreeType 2 before 2016-12-16 has an out-of-bounds write caused by a heap-based buffer overflow related to the cff_parser_run function in cff/cffparse.c |
| CVE-2016-10244 | FR Freetype Freetype | 7.8 | Mar 6 | The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of… |
| CVE-2014-9747 | FR Freetype Freetype | 7.5 | Jun 7 | The t42_parse_encoding function in type42/t42parse.c in FreeType before 2.5.4 does not properly update the current position for immediates-only mode, which allows remote attackers… |
| CVE-2014-9746 | FR Freetype Freetype | 9.8 | Jun 7 | The (1) t1_parse_font_matrix function in type1/t1load.c, (2) cid_parse_font_matrix function in cid/cidload.c, (3) t42_parse_font_matrix function in type42/t42parse.c, and (4)… |
| CVE-2014-9745 | FR Freetype Freetype | – | Sep 14 | The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a "broken number-with-base" in a… |
| CVE-2014-9675 | FR Freetype Freetype | – | Feb 8 | bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer… |
| CVE-2014-9674 | FR Freetype Freetype | – | Feb 8 | The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote… |
| CVE-2014-9673 | FR Freetype Freetype | – | Feb 8 | Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer… |
| CVE-2014-9672 | FR Freetype Freetype | – | Feb 8 | Array index error in the parse_fond function in base/ftmac.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive… |
| CVE-2014-9671 | FR Freetype Freetype | – | Feb 8 | Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and… |
| CVE-2014-9670 | FR Freetype Freetype | – | Feb 8 | Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer… |
| CVE-2014-9669 | FR Freetype Freetype | – | Feb 8 | Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have… |
| CVE-2014-9668 | FR Freetype Freetype | – | Feb 8 | The woff_open_font function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting length values, which allows remote attackers to… |
| CVE-2014-9667 | FR Freetype Freetype | – | Feb 8 | sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service (integer… |
| CVE-2014-9666 | FR Freetype Freetype | – | Feb 8 | The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote… |
| CVE-2014-9665 | FR Freetype Freetype | – | Feb 8 | The Load_SBit_Png function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows remote attackers to cause a denial of… |
| CVE-2014-9664 | FR Freetype Freetype | – | Feb 8 | FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or… |
| CVE-2014-9663 | FR Freetype Freetype | – | Feb 8 | The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, which allows remote… |
| CVE-2014-9662 | FR Freetype Freetype | – | Feb 8 | cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows remote attackers to cause a denial of service (heap-based… |
| CVE-2014-9661 | FR Freetype Freetype | – | Feb 8 | type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of… |
| CVE-2014-9660 | FR Freetype Freetype | – | Feb 8 | The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of… |
| CVE-2014-9659 | FR Freetype Freetype | – | Feb 8 | cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint mask has been computed, which allows remote attackers to… |
| CVE-2014-9658 | FR Freetype Freetype | – | Feb 8 | The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service… |
| CVE-2014-9657 | FR Freetype Freetype | – | Feb 8 | The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service… |
| CVE-2014-9656 | FR Freetype Freetype | – | Feb 8 | The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType before 2.5.4 does not properly check for an integer overflow, which allows remote attackers to cause a denial… |
| CVE-2014-2241 | FR Freetype Freetype | – | Mar 18 | The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows… |
| CVE-2014-2240 | FR Freetype Freetype | – | Mar 12 | Stack-based buffer overflow in the cf2_hintmap_build function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (crash) and possibly… |
| CVE-2012-5670 | FR Freetype Freetype | – | Jan 24 | The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) via vectors related to BDF… |
| CVE-2012-5669 | FR Freetype Freetype | – | Jan 24 | The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors… |
| CVE-2012-5668 | FR Freetype Freetype | – | Jan 24 | FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to BDF fonts and the improper… |
| CVE-2012-1144 | FR Freetype Freetype | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and… |
| CVE-2012-1143 | FR Freetype Freetype | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (divide-by-zero error) via a… |
| CVE-2012-1142 | FR Freetype Freetype | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and… |
| CVE-2012-1141 | FR Freetype Freetype | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and… |
| CVE-2012-1140 | FR Freetype Freetype | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and… |
| CVE-2012-1139 | FR Freetype Freetype | – | Apr 25 | Array index error in FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid stack… |
| CVE-2012-1138 | FR Freetype Freetype | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and… |
| CVE-2012-1137 | FR Freetype Freetype | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and… |
| CVE-2012-1136 | FR Freetype Freetype | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and… |
| CVE-2012-1135 | FR Freetype Freetype | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and… |
| CVE-2012-1134 | FR Freetype Freetype | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and… |
| CVE-2012-1133 | FR Freetype Freetype | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and… |
| CVE-2012-1132 | FR Freetype Freetype | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and… |