Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-27363: An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | freetype | 0:2.13.2-5.amzn2023.0.1 |
| Amazon Linux · 2023 | freetype-debuginfo | 0:2.13.2-5.amzn2023.0.1 |
| Amazon Linux · 2023 | freetype-debugsource | 0:2.13.2-5.amzn2023.0.1 |
| Amazon Linux · 2023 | freetype-demos | 0:2.13.2-5.amzn2023.0.1 |
| Amazon Linux · 2023 | freetype-demos-debuginfo | 0:2.13.2-5.amzn2023.0.1 |
| Amazon Linux · 2023 | freetype-devel | 0:2.13.2-5.amzn2023.0.1 |
Vulnerabilities 1
-
High 8.1
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) whe…
KEV May 6, 2025
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-27363.html