{"id":"MGASA-2017-0124","summary":"Updated freetype2 packages fix security vulnerability","details":"It was discovered that a heap-based buffer overflow existed in the\nFreeType library. If a user were tricked into using a specially crafted\nfont file, a remote attacker could cause FreeType to crash, resulting in a\ndenial of service, or possibly execute arbitrary code (CVE-2016-10328).\n\nFreeType 2 before 2017-03-24 has an out-of-bounds write caused by a\nheap-based buffer overflow related to the t1_decoder_parse_charstrings\nfunction in psaux/t1decode.c (CVE-2017-8105).\n\nFreeType 2 before 2017-03-26 has an out-of-bounds write caused by a\nheap-based buffer overflow related to the t1_builder_close_contour\nfunction in psaux/psobjs.c (CVE-2017-8287).\n","modified":"2026-02-04T03:18:28.920401Z","published":"2017-05-02T06:37:59Z","related":["CVE-2016-10328","CVE-2017-8105","CVE-2017-8287"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2017-0124.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=20720"},{"type":"REPORT","url":"https://www.ubuntu.com/usn/usn-3263-1/"},{"type":"REPORT","url":"https://www.debian.org/security/2017/dsa-3839"}],"affected":[{"package":{"name":"freetype2","ecosystem":"Mageia:5","purl":"pkg:rpm/mageia/freetype2?arch=source&distro=mageia-5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.4-2.3.mga5"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2017-0124.json"}},{"package":{"name":"freetype2","ecosystem":"Mageia:5","purl":"pkg:rpm/mageia/freetype2?arch=source&distro=mageia-5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.4-2.3.mga5.tainted"}]}],"ecosystem_specific":{"section":"tainted"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2017-0124.json"}}],"schema_version":"1.7.3","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}