CVE-2008-1806

Published: 16 June 2008

Integer overflow in FreeType2 before 2.3.6 allows context-dependent attackers to execute arbitrary code via a crafted set of 16-bit length values within the Private dictionary table in a Printer Font Binary (PFB) file, which triggers a heap-based buffer overflow.

Priority

Status

Package	Release	Status
freetype Launchpad, Ubuntu, Debian	dapper	Released (2.1.10-1ubuntu2.5)
	feisty	Released (2.2.1-5ubuntu1.2)
	gutsy	Released (2.3.5-1ubuntu4.7.10.1)
	hardy	Released (2.3.5-1ubuntu4.8.04.1)
	upstream	Released (2.3.6-1)

References

https://ubuntu.com/security/notices/USN-643-1
https://www.cve.org/CVERecord?id=CVE-2008-1806
NVD
Launchpad
Debian

Bugs

https://bugs.launchpad.net/ubuntu/+source/freetype/+bug/251369
https://bugs.launchpad.net/bugs/238977

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›