Heap-based Buffer Over-read in FreeType Affects Multiple Systems

CVE-2015-9381

Summary

A vulnerability in FreeType affects its ability to parse Type 1 fonts, resulting in a heap-based buffer over-read. This can lead to potential exposure of sensitive information or cause unexpected behavior in applications utilizing this library. The issue stems from the T1_Get_Private_Dict function found in t1parse.c, which can mishandle memory allocation when processing malformed font files. This vulnerability underscores the importance of keeping FreeType updated to the latest version to mitigate security risks.

References