CVE-2010-2527

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2010-2527
Multiple buffer overflows in demo programs in FreeType before 2.4.0 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://git.savannah.gnu.org/cgit/freetype/freetype2-demos.git/commit/?id=b995299b73ba4cd259f221f500d4e63095508bec Patch Third Party Advisory
http://lists.nongnu.org/archive/html/freetype/2010-07/msg00001.html Mailing List Release Notes Third Party Advisory
http://marc.info/?l=oss-security&m=127912955808467&w=2 Mailing List Third Party Advisory
http://savannah.nongnu.org/bugs/?30054 Issue Tracking Third Party Advisory
http://secunia.com/advisories/48951 Third Party Advisory
http://securitytracker.com/id?1024266 Third Party Advisory VDB Entry
http://www.debian.org/security/2010/dsa-2070 Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2010-0577.html Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2010-0578.html Third Party Advisory
http://www.ubuntu.com/usn/USN-963-1 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=614557 Issue Tracking Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
History

06 Apr 2021, 12:51

Type Values Removed Values Added
References (CONFIRM) http://git.savannah.gnu.org/cgit/freetype/freetype2-demos.git/commit/?id=b995299b73ba4cd259f221f500d4e63095508bec - (CONFIRM) http://git.savannah.gnu.org/cgit/freetype/freetype2-demos.git/commit/?id=b995299b73ba4cd259f221f500d4e63095508bec - Patch, Third Party Advisory
References (DEBIAN) http://www.debian.org/security/2010/dsa-2070 - (DEBIAN) http://www.debian.org/security/2010/dsa-2070 - Third Party Advisory
References (UBUNTU) http://www.ubuntu.com/usn/USN-963-1 - (UBUNTU) http://www.ubuntu.com/usn/USN-963-1 - Third Party Advisory
References (REDHAT) http://www.redhat.com/support/errata/RHSA-2010-0578.html - (REDHAT) http://www.redhat.com/support/errata/RHSA-2010-0578.html - Third Party Advisory
References (SECTRACK) http://securitytracker.com/id?1024266 - (SECTRACK) http://securitytracker.com/id?1024266 - Third Party Advisory, VDB Entry
References (SECUNIA) http://secunia.com/advisories/48951 - (SECUNIA) http://secunia.com/advisories/48951 - Third Party Advisory
References (MLIST) http://lists.nongnu.org/archive/html/freetype/2010-07/msg00001.html - Patch (MLIST) http://lists.nongnu.org/archive/html/freetype/2010-07/msg00001.html - Mailing List, Release Notes, Third Party Advisory
References (CONFIRM) http://savannah.nongnu.org/bugs/?30054 - (CONFIRM) http://savannah.nongnu.org/bugs/?30054 - Issue Tracking, Third Party Advisory
References (REDHAT) http://www.redhat.com/support/errata/RHSA-2010-0577.html - (REDHAT) http://www.redhat.com/support/errata/RHSA-2010-0577.html - Third Party Advisory
References (CONFIRM) https://bugzilla.redhat.com/show_bug.cgi?id=614557 - (CONFIRM) https://bugzilla.redhat.com/show_bug.cgi?id=614557 - Issue Tracking, Patch, Third Party Advisory
References (MLIST) http://marc.info/?l=oss-security&m=127912955808467&w=2 - (MLIST) http://marc.info/?l=oss-security&m=127912955808467&w=2 - Mailing List, Third Party Advisory
CPE cpe:2.3:a:freetype:freetype:2.2.10:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.2.0:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.1:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.1.9:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.1:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.1.10:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.4:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.5:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.0.9:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.8:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.9:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.2:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.1.6:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.11:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.1.7:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.6:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.2.1:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.0.6:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.0:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.10:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.3:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.1.3:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.1.8:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.1.5:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.3.7:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.1.4:*:*:*:*:*:*:*		 cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*
CWE CWE-119 CWE-120

26 Jan 2021, 12:43

Type Values Removed Values Added
CPE cpe:2.3:a:freetype:freetype:2.2:*:*:*:*:*:*:*
cpe:2.3:a:freetype:freetype:2.1.8_rc1:*:*:*:*:*:*:*		 cpe:2.3:a:freetype:freetype:2.2.0:*:*:*:*:*:*:*
Information

Published : 2010-08-19 18:00

Updated : 2023-12-10 11:03

NVD link : CVE-2010-2527

Mitre link : CVE-2010-2527

CVE.ORG link : CVE-2010-2527

JSON object : View

Products Affected

debian

  • debian_linux

canonical

  • ubuntu_linux

freetype

  • freetype
CWE
CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')