Your submission was sent successfully! Close

CVE-2022-27404

Published: 22 April 2022

FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face.

Notes

AuthorNote
rodrigo-zaiden
vulnerable code was actually introduced in commit
https://gitlab.freedesktop.org/freetype/freetype/-/commit/63765a8f
(version 2.8), the commit in the description is the commit
used to sync and test the reproducer.
Priority

Medium

CVSS 3 base score: 9.8

Status

Package Release Status
freetype
Launchpad, Ubuntu, Debian
bionic
Released (2.8.1-2ubuntu2.2)
focal
Released (2.10.1-2ubuntu0.2)
impish Ignored
(reached end-of-life)
jammy
Released (2.11.1+dfsg-1ubuntu0.1)
kinetic Not vulnerable
(2.12.1+dfsg-2)
trusty Not vulnerable
(code-not-present)
upstream
Released (2.11.1+dfsg-2,2.12.0)
xenial Not vulnerable
(code-not-present)
Patches:
upstream: https://gitlab.freedesktop.org/freetype/freetype/-/commit/53dfdcd8198d2b3201a23c4bad9190519ba918db