search menu icon-carat-right cmu-wordmark
Carnegie Mellon University

Software Engineering Institute

CERT Coordination Center

FreeType 2 CFF font stack corruption vulnerability

Vulnerability Note VU#275247

Original Release Date: 2010-08-05 | Last Revised: 2010-09-14

Overview

FreeType 2 contains a vulnerability in the processing of CFF fonts, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.

Description

FreeType is a font engine that can open and process font files. FreeType 2 includes the ability to handle a number of font types, including Compact Font Format (CFF). FreeType is used by a number of applications, including PDF readers, web browsers, and other applications. FreeType 2 contains a flaw in the handling of some CFF opcodes, which can result in stack corruption. This can allow arbitrary code execution.

This vulnerability is being used in the iPhone PDF JailBreak exploit.

Impact

By causing an application that uses FreeType to parse a specially-crafted CFF font, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. This can occur as the result of opening a PDF document or viewing a web page.

Solution

Apply an update
This vulnerability is fixed in the FreeType source tree. Please check with your vendor for an update.

Vendor Information

275247
 
Expand all

View all 42 vendors View less vendors


CVSS Metrics

Group Score Vector
Base
Temporal
Environmental

References

Acknowledgements

This vulnerability was discovered being exploited in the wild. Additional analysis was performed by Braden Thomas of Apple Product Security.

This document was written by Will Dormann.

Other Information

CVE IDs: CVE-2010-1797
Severity Metric: 13.39
Date Public: 2010-08-02
Date First Published: 2010-08-05
Date Last Updated: 2010-09-14 10:17 UTC
Document Revision: 30

Sponsored by CISA.

Download PGP Key

Read CERT/CC Blog

Learn about Vulnerability Analysis