Skip to content
OpenAdvisories
High 1 exploited CVE ALAS2023-2025-925 1 CVE

Important: freetype security update (Amazon Linux 2023)

Published Apr 7, 2025 · Updated Apr 14, 2025

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-27363: An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2023 freetype 0:2.13.2-5.amzn2023.0.1
Amazon Linux · 2023 freetype-debuginfo 0:2.13.2-5.amzn2023.0.1
Amazon Linux · 2023 freetype-debugsource 0:2.13.2-5.amzn2023.0.1
Amazon Linux · 2023 freetype-demos 0:2.13.2-5.amzn2023.0.1
Amazon Linux · 2023 freetype-demos-debuginfo 0:2.13.2-5.amzn2023.0.1
Amazon Linux · 2023 freetype-devel 0:2.13.2-5.amzn2023.0.1

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-27363.html