Errata overview
Errata ID 416
Date 2017-05-10
Source package freetype
Fixed in version 2.4.9-1.1.74.201704181350
Description
This update addresses the following issues:
* remote denial of service (integer overflow and heap-based buffer overflow)
  or possibly unspecified other impact via a crafted Mac font (CVE-2014-9674)
* remote denial of service (infinite loop) via a "broken number-with-base"
  in a Postscript stream (CVE-2014-9745)
* uninitialized memory access and application crash or possibly unspecified
  other impact via a crafted font (CVE-2014-9746)
* remote denial of service (infinite loop) via a Type42 font (CVE-2014-9747)
* remote denial of service (heap-based buffer over-read) or possibly
  unspecified other impact via a crafted file (CVE-2016-10244)
* out-of-bounds write caused by a heap-based buffer overflow related to
  the cff_parser_run function in cff/cffparse.c (CVE-2016-10328)
Additional notes
CVE ID CVE-2014-9674
CVE-2014-9745
CVE-2014-9746
CVE-2014-9747
CVE-2016-10244
CVE-2016-10328
UCS Bug number #40548