Description
Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | freetype | 2.3.9-4.1 | — |
| Debian 13 | freetype | 2.3.9-4.1 | — |
| Debian 12 | freetype | 2.3.9-4.1 | — |
| Debian 5.0 | freetype | 2.3.7-2+lenny1 | DSA-1784-1 |
| Debian 4.0 | freetype | 2.2.1-5+etch4 | DSA-1784-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | freetype +2 | 2.2.1-21.el5_3 | RHSA-2009:1061 |
| RHEL 4 | freetype +3 | 2.1.9-10.el4.7 | RHSA-2009:0329 |
| RHEL 3 | freetype +1 | 2.1.4-12.el3 | RHSA-2009:0329 |
| RHEL 2 | freetype +2 | 2.0.3-17.el21 | RHSA-2009:1062 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ft2demos +1 | 2.7-1.1 | openSUSE-SU-2024:10438-1, openSUSE-SU-2024:10172-1 |
Advisories 6
- RHSA-2009:1061 Red Hat Security Advisory: freetype security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1062 Red Hat Security Advisory: freetype security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:0329 Red Hat Security Advisory: freetype security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1784-1 freetype - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10438-1 freetype2-devel-2.7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10172-1 ft2demos-2.7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 34967 third-party-advisory
- http://support.apple.com/kb/HT3639
- http://support.apple.com/kb/HT4435
- 34913 third-party-advisory
- http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=a18788b14db60ae3673f932249cd02d33a227c4e
- ADV-2009-1621 vdb-entry
- 34550 vdb-entry
- http://support.apple.com/kb/HT3549
- MDVSA-2009:243 vendor-advisory
- APPLE-SA-2009-06-08-1 vendor-advisory
- USN-767-1 vendor-advisory
- 270268 vendor-advisory
- 35198 third-party-advisory
- http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=79972af4f0485a11dcb19551356c45245749fc5b
- 35074 third-party-advisory
- http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0545ec1ca36b27cb928128870a83e5f668980bc5
- ADV-2009-1522 vdb-entry
- APPLE-SA-2010-11-10-1 vendor-advisory
- RHSA-2009:1062 vendor-advisory
- APPLE-SA-2009-06-17-1 vendor-advisory
- APPLE-SA-2009-05-12 vendor-advisory
- 35065 third-party-advisory
- DSA-1784 vendor-advisory
- 35210 third-party-advisory
- GLSA-200905-05 vendor-advisory
- 35379 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=491384
- oval:org.mitre.oval:def:10149 vdb-entry signature
- http://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/ChangeLog
- SUSE-SR:2009:010 vendor-advisory
- TA09-133A third-party-advisory
- ADV-2009-1297 vdb-entry
- 35200 third-party-advisory
- http://support.apple.com/kb/HT3613
- RHSA-2009:0329 vendor-advisory
- ADV-2009-1058 vdb-entry
- 35204 third-party-advisory
- 34723 third-party-advisory
- RHSA-2009:1061 vendor-advisory