Description
FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | freetype | 2.6.1-0.1 | — |
| Debian 13 | freetype | 2.6.1-0.1 | — |
| Debian 12 | freetype | 2.6.1-0.1 | — |
| Debian 8 | freetype | 2.5.2-3+deb8u4 | DLA-1909-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | freetype | 2.5.2-1ubuntu2.8+esm1 | USN-4126-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | PackageKit +8 | 1.1.10-1.el7 | RHSA-2018:3140 |
| RHEL 7 | accountsservice +2 | 0.6.50-2.el7 | RHSA-2018:3140 |
| RHEL 7 | adwaita-gtk2-theme +1 | 3.28-2.el7 | RHSA-2018:3140 |
| RHEL 7 | appstream-data | 7-20180614.el7 | RHSA-2018:3140 |
| RHEL 7 | at-spi2-atk +1 | 2.26.2-1.el7 | RHSA-2018:3140 |
| RHEL 7 | at-spi2-core +1 | 2.28.0-1.el7 | RHSA-2018:3140 |
| RHEL 7 | atk +1 | 2.28.1-1.el7 | RHSA-2018:3140 |
| RHEL 7 | baobab +1 | 3.28.0-2.el7 | RHSA-2018:3140 |
| RHEL 7 | bolt | 0.4-3.el7 | RHSA-2018:3140 |
| RHEL 7 | brasero +3 | 3.12.2-5.el7 | RHSA-2018:3140 |
| RHEL 7 | cairo +4 | 1.15.12-3.el7 | RHSA-2018:3140 |
| RHEL 7 | cheese +2 | 2:3.28.0-1.el7 | RHSA-2018:3140 |
| RHEL 7 | clutter-gst3 +1 | 3.0.26-1.el7 | RHSA-2018:3140 |
| RHEL 7 | compat-exiv2-023 | 0.23-2.el7 | RHSA-2018:3140 |
| RHEL 7 | compat-libical1 | 1.0.1-2.el7 | RHSA-2018:3140 |
| RHEL 7 | control-center +1 | 1:3.28.1-4.el7 | RHSA-2018:3140 |
| RHEL 7 | dconf +1 | 0.28.0-4.el7 | RHSA-2018:3140 |
| RHEL 7 | devhelp +2 | 1:3.28.1-1.el7 | RHSA-2018:3140 |
| RHEL 7 | ekiga | 4.0.1-8.el7 | RHSA-2018:3140 |
| RHEL 7 | empathy | 3.12.13-1.el7 | RHSA-2018:3140 |
| RHEL 7 | eog +3 | 3.28.3-1.el7 | RHSA-2018:3140 |
| RHEL 7 | evince +5 | 3.28.2-5.el7 | RHSA-2018:3140 |
| RHEL 7 | evolution +9 | 3.28.5-2.el7 | RHSA-2018:3140 |
| RHEL 7 | evolution-ews +7 | 3.28.5-1.el7 | RHSA-2018:3140 |
| RHEL 7 | evolution-mapi +1 | 3.28.3-2.el7 | RHSA-2018:3140 |
| RHEL 7 | file-roller +3 | 3.28.1-2.el7 | RHSA-2018:3140 |
| RHEL 7 | flatpak +2 | 1.0.2-2.el7 | RHSA-2018:3140 |
| RHEL 7 | flatpak-builder | 1.0.0-2.el7 | RHSA-2018:3140 |
| RHEL 7 | folks +2 | 1:0.11.4-1.el7 | RHSA-2018:3140 |
| RHEL 7 | fontconfig +2 | 2.13.0-4.3.el7 | RHSA-2018:3140 |
| RHEL 7 | freetype | 2.8-12.el7 | RHSA-2018:3140 |
| RHEL 7 | fwupd | 1.0.8-4.el7 | RHSA-2018:3140 |
| RHEL 7 | fwupdate +2 | 12-5.el7 | RHSA-2018:3140 |
| RHEL 7 | gcr +15 | 3.28.0-1.el7 | RHSA-2018:3140 |
| RHEL 7 | gdk-pixbuf2 | 2.36.12-3.el7 | RHSA-2018:3140 |
| RHEL 7 | gdm | 1:3.28.2-9.el7 | RHSA-2018:3140 |
| RHEL 7 | geoclue2 +1 | 2.4.8-1.el7 | RHSA-2018:3140 |
| RHEL 7 | geocode-glib | 3.26.0-2.el7 | RHSA-2018:3140 |
| RHEL 7 | gjs | 1.52.3-1.el7 | RHSA-2018:3140 |
| RHEL 7 | glade +1 | 3.22.1-1.el7 | RHSA-2018:3140 |
| RHEL 7 | glib-networking | 2.56.1-1.el7 | RHSA-2018:3140 |
| RHEL 7 | glib2 | 2.56.1-2.el7 | RHSA-2018:3140 |
| RHEL 7 | glibmm24 | 2.56.0-1.el7 | RHSA-2018:3140 |
| RHEL 7 | gnome-bluetooth +1 | 1:3.28.2-1.el7 | RHSA-2018:3140 |
| RHEL 7 | gnome-dictionary | 3.26.1-2.el7 | RHSA-2018:3140 |
| RHEL 7 | gnome-keyring +8 | 3.28.2-1.el7 | RHSA-2018:3140 |
| RHEL 7 | gnome-session +11 | 3.28.1-5.el7 | RHSA-2018:3140 |
| RHEL 7 | gnome-shell | 3.28.3-6.el7 | RHSA-2018:3140 |
| RHEL 7 | gnome-software | 3.28.2-3.el7 | RHSA-2018:3140 |
| RHEL 7 | gobject-introspection | 1.56.1-1.el7 | RHSA-2018:3140 |
| RHEL 7 | gom | 0.3.3-1.el7 | RHSA-2018:3140 |
| RHEL 7 | google-noto-emoji-fonts +1 | 20180508-4.el7 | RHSA-2018:3140 |
| RHEL 7 | grilo | 0.3.6-1.el7 | RHSA-2018:3140 |
| RHEL 7 | grilo-plugins | 0.3.7-1.el7 | RHSA-2018:3140 |
| RHEL 7 | gspell | 1.6.1-1.el7 | RHSA-2018:3140 |
| RHEL 7 | gssdp +3 | 1.0.2-1.el7 | RHSA-2018:3140 |
| RHEL 7 | gstreamer1-plugins-base | 1.10.4-2.el7 | RHSA-2018:3140 |
| RHEL 7 | gtk3 +2 | 3.22.30-3.el7 | RHSA-2018:3140 |
| RHEL 7 | gtksourceview3 | 3.24.8-1.el7 | RHSA-2018:3140 |
| RHEL 7 | gucharmap +1 | 10.0.4-1.el7 | RHSA-2018:3140 |
| RHEL 7 | gupnp | 1.0.2-5.el7 | RHSA-2018:3140 |
| RHEL 7 | gupnp-igd | 0.2.5-2.el7 | RHSA-2018:3140 |
| RHEL 7 | gvfs +9 | 1.36.2-1.el7 | RHSA-2018:3140 |
| RHEL 7 | harfbuzz +1 | 1.7.5-2.el7 | RHSA-2018:3140 |
| RHEL 7 | json-glib | 1.4.2-2.el7 | RHSA-2018:3140 |
| RHEL 7 | libappstream-glib | 0.7.8-2.el7 | RHSA-2018:3140 |
| RHEL 7 | libchamplain +1 | 0.12.16-2.el7 | RHSA-2018:3140 |
| RHEL 7 | libcroco | 0.6.12-4.el7 | RHSA-2018:3140 |
| RHEL 7 | libgdata | 0.17.9-1.el7 | RHSA-2018:3140 |
| RHEL 7 | libgee | 0.20.1-1.el7 | RHSA-2018:3140 |
| RHEL 7 | libgepub | 0.6.0-1.el7 | RHSA-2018:3140 |
| RHEL 7 | libgexiv2 | 0.10.8-1.el7 | RHSA-2018:3140 |
| RHEL 7 | libgnomekbd +2 | 3.26.0-1.el7 | RHSA-2018:3140 |
| RHEL 7 | libgovirt | 0.3.4-1.el7 | RHSA-2018:3140 |
| RHEL 7 | libgtop2 | 2.38.0-3.el7 | RHSA-2018:3140 |
| RHEL 7 | libgweather +3 | 3.28.2-2.el7 | RHSA-2018:3140 |
| RHEL 7 | libgxps | 0.3.0-4.el7 | RHSA-2018:3140 |
| RHEL 7 | libical | 3.0.3-2.el7 | RHSA-2018:3140 |
| RHEL 7 | libjpeg-turbo | 1.2.90-6.el7 | RHSA-2018:3140 |
| RHEL 7 | libmediaart | 1.9.4-1.el7 | RHSA-2018:3140 |
| RHEL 7 | libosinfo | 1.1.0-2.el7 | RHSA-2018:3140 |
| RHEL 7 | libpeas +2 | 1.22.0-1.el7 | RHSA-2018:3140 |
| RHEL 7 | librsvg2 +1 | 2.40.20-1.el7 | RHSA-2018:3140 |
| RHEL 7 | libsecret | 0.18.6-1.el7 | RHSA-2018:3140 |
| RHEL 7 | libsoup | 2.62.2-2.el7 | RHSA-2018:3140 |
| RHEL 7 | libwnck3 | 3.24.1-2.el7 | RHSA-2018:3140 |
| RHEL 7 | mozjs52 | 52.9.0-1.el7 | RHSA-2018:3140 |
| RHEL 7 | mutter | 3.28.3-4.el7 | RHSA-2018:3140 |
| RHEL 7 | nautilus +1 | 3.26.3.1-2.el7 | RHSA-2018:3140 |
| RHEL 7 | nautilus-sendto | 1:3.8.6-1.el7 | RHSA-2018:3140 |
| RHEL 7 | openchange | 2.3-3.el7 | RHSA-2018:3140 |
| RHEL 7 | osinfo-db | 20180531-1.el7 | RHSA-2018:3140 |
| RHEL 7 | pango | 1.42.4-1.el7 | RHSA-2018:3140 |
| RHEL 7 | poppler +3 | 0.26.5-20.el7 | RHSA-2018:3140 |
| RHEL 7 | pyatspi +1 | 2.26.0-3.el7 | RHSA-2018:3140 |
| RHEL 7 | redhat-logos | 70.0.3-7.el7 | RHSA-2018:3140 |
| RHEL 7 | rest | 0.8.1-2.el7 | RHSA-2018:3140 |
| RHEL 7 | rhythmbox | 3.4.2-2.el7 | RHSA-2018:3140 |
| RHEL 7 | seahorse-nautilus | 3.11.92-11.el7 | RHSA-2018:3140 |
| RHEL 7 | shotwell | 0.28.4-1.el7 | RHSA-2018:3140 |
| RHEL 7 | totem +1 | 1:3.26.2-1.el7 | RHSA-2018:3140 |
| RHEL 7 | totem-pl-parser | 3.26.1-1.el7 | RHSA-2018:3140 |
| RHEL 7 | upower | 0.99.7-1.el7 | RHSA-2018:3140 |
| RHEL 7 | vino | 3.22.0-7.el7 | RHSA-2018:3140 |
| RHEL 7 | vte291 +1 | 0.52.2-2.el7 | RHSA-2018:3140 |
| RHEL 7 | wayland +5 | 1.15.0-1.el7 | RHSA-2018:3140 |
| RHEL 7 | wayland-protocols +1 | 1.14-1.el7 | RHSA-2018:3140 |
| RHEL 7 | webkitgtk4 +2 | 2.20.5-1.el7 | RHSA-2018:3140 |
| RHEL 7 | yelp +2 | 2:3.28.1-1.el7 | RHSA-2018:3140 |
| RHEL 7 | zenity +17 | 3.28.1-1.el7 | RHSA-2018:3140 |
| RHEL 6 | freetype +2 | 2.3.11-19.el6_10 | RHSA-2019:4254 |
Advisories 4
- RHSA-2018:3140 Red Hat Security Advisory: GNOME security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2019:4254 Red Hat Security Advisory: freetype security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- USN-4126-2 freetype vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-1909-1 freetype - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/src/type1/t1parse.c?id=7962a15d64c876870ca0ae435ea2467d9be268d9
- https://savannah.nongnu.org/bugs/?45955
- [debian-lts-announce] 20190904 [SECURITY] [DLA 1909-1] freetype security update mailing-list
- USN-4126-2 vendor-advisory
- RHSA-2019:4254 vendor-advisory