6.8 - CVE-2007-2754

Executive Summary

Informations
Name	CVE-2007-2754	First vendor Publication	2007-05-17
Vendor	Cve	Last vendor Modification	2023-02-13

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score	6.8	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Integer signedness error in truetype/ttgload.c in Freetype 2.3.4 and earlier might allow remote attackers to execute arbitrary code via a crafted TTF image with a negative n_points value, which leads to an integer overflow and heap-based buffer overflow.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2754

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11325

Oval ID:	oval:org.mitre.oval:def:11325
Title:	Integer signedness error in truetype/ttgload.c in Freetype 2.3.4 and earlier might allow remote attackers to execute arbitrary code via a crafted TTF image with a negative n_points value, which leads to an integer overflow and heap-based buffer overflow.
Description:	Integer signedness error in truetype/ttgload.c in Freetype 2.3.4 and earlier might allow remote attackers to execute arbitrary code via a crafted TTF image with a negative n_points value, which leads to an integer overflow and heap-based buffer overflow.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-2754	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section freetype is earlier than 0:2.1.4-12.el3 AND freetype-devel is earlier than 0:2.1.4-12.el3 AND freetype-demos is earlier than 0:2.1.4-12.el3 AND freetype-utils is earlier than 0:2.1.4-12.el3 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section freetype is earlier than 0:2.1.9-10.el4.7 AND freetype-demos is earlier than 0:2.1.9-10.el4.7 AND freetype-devel is earlier than 0:2.1.9-10.el4.7 AND freetype-utils is earlier than 0:2.1.9-10.el4.7 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section freetype is earlier than 0:2.2.1-19.el5 AND freetype-demos is earlier than 0:2.2.1-19.el5 AND freetype-devel is earlier than 0:2.2.1-19.el5

Definition Id: oval:org.mitre.oval:def:18574

Oval ID:	oval:org.mitre.oval:def:18574
Title:	DSA-1302-1 freetype - integer overflow
Description:	A problem was discovered in freetype, a FreeType2 font engine, which could allow the execution of arbitrary code via an integer overflow in specially crafted TTF files.
Family:	unix	Class:	patch
Reference(s):	DSA-1302-1 CVE-2007-2754	Version:	7
Platform(s):	Debian GNU/Linux 4.0	Product(s):	freetype
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND freetype DPKG is earlier than 2.2.1-5+etch1

Definition Id: oval:org.mitre.oval:def:21823

Oval ID:	oval:org.mitre.oval:def:21823
Title:	ELSA-2007:0403: freetype security update (Moderate)
Description:	Integer signedness error in truetype/ttgload.c in Freetype 2.3.4 and earlier might allow remote attackers to execute arbitrary code via a crafted TTF image with a negative n_points value, which leads to an integer overflow and heap-based buffer overflow.
Family:	unix	Class:	patch
Reference(s):	ELSA-2007:0403-02 CVE-2007-2754	Version:	6
Platform(s):	Oracle Linux 5	Product(s):	freetype
Definition Synopsis:
Oracle Linux 5.x rpm test freetype is earlier than 0:2.2.1-19.el5 AND freetype-demos is earlier than 0:2.2.1-19.el5 AND freetype-devel is earlier than 0:2.2.1-19.el5

Definition Id: oval:org.mitre.oval:def:5532

Oval ID:	oval:org.mitre.oval:def:5532
Title:	Security Vulnerability in FreeType 2 Font Engine May Allow Privilege Escalation Due to Heap Overflow
Description:	Integer signedness error in truetype/ttgload.c in Freetype 2.3.4 and earlier might allow remote attackers to execute arbitrary code via a crafted TTF image with a negative n_points value, which leads to an integer overflow and heap-based buffer overflow.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-2754	Version:	1
Platform(s):	Sun Solaris 8 Sun Solaris 9 Sun Solaris 10	Product(s):
Definition Synopsis:
Solaris 8 (SPARC) meets Sun Alert 103171 Solaris 8 (SPARC) is installed AND NOT Patch 124420-03 or later installed OR Solaris 9 (SPARC) meets Sun Alert 103171 Solaris 9 (SPARC) is installed AND NOT Patch 116105-08 or later installed OR Solaris 10 (SPARC) meets Sun Alert 103171 Solaris 10 (SPARC) is installed AND NOT Patch 119812-05 or later installed OR Solaris 8 (x86) meets Sun Alert 103171 Solaris 8 (x86) is installed AND NOT Patch 124421-03 or later installed OR Solaris 9 (x86) meets Sun Alert 103171 Solaris 9 (x86) is installed AND NOT Patch 116106-07 or later installed OR Solaris 10 (x86) meets Sun Alert 103171 Solaris 10 (x86) is installed AND NOT Patch 119813-07 or later installed

CPE : Common Platform Enumeration

Type	Description	Count
Application	Freetype cpe:2.3:a:freetype:freetype:2.3.4:::::::* cpe:2.3:a:freetype:freetype:2.3.3:::::::* cpe:2.3:a:freetype:freetype:2.3.2:::::::* cpe:2.3:a:freetype:freetype:2.3.1:::::::* cpe:2.3:a:freetype:freetype:2.3.0:-:::::: cpe:2.3:a:freetype:freetype:2.2.10:::::::* cpe:2.3:a:freetype:freetype:2.2.1:::::::* cpe:2.3:a:freetype:freetype:2.2.0:-:::::: cpe:2.3:a:freetype:freetype:2.2.0:::::::* cpe:2.3:a:freetype:freetype:2.1.9:::::::* cpe:2.3:a:freetype:freetype:2.1.8:-:::::: cpe:2.3:a:freetype:freetype:2.1.8:rc1:::::: cpe:2.3:a:freetype:freetype:2.1.7:::::::* cpe:2.3:a:freetype:freetype:2.1.6:::::::* cpe:2.3:a:freetype:freetype:2.1.5:-:::::: cpe:2.3:a:freetype:freetype:2.1.4:-:::::: cpe:2.3:a:freetype:freetype:2.1.3:::::::* cpe:2.3:a:freetype:freetype:2.1.10:::::::* cpe:2.3:a:freetype:freetype:2.1:::::::* cpe:2.3:a:freetype:freetype:2.0.9:::::::* cpe:2.3:a:freetype:freetype:2.0.8:::::::* cpe:2.3:a:freetype:freetype:2.0.7:::::::* cpe:2.3:a:freetype:freetype:2.0.6:::::::* cpe:2.3:a:freetype:freetype:2.0.5:::::::* cpe:2.3:a:freetype:freetype:2.0.4:::::::* cpe:2.3:a:freetype:freetype:2.0.3:::::::* cpe:2.3:a:freetype:freetype:2.0.2:::::::* cpe:2.3:a:freetype:freetype:2.0.1:::::::* cpe:2.3:a:freetype:freetype:2.0.0:-:::::: cpe:2.3:a:freetype:freetype:2.0.0:::::::* cpe:2.3:a:freetype:freetype:1.3.1:::::::* cpe:2.3:a:freetype:freetype::::::::	32

OpenVAS Exploits

Date	Description
2011-08-09	Name : CentOS Update for freetype CESA-2009:0329 centos3 i386 File : nvt/gb_CESA-2009_0329_freetype_centos3_i386.nasl
2011-03-09	Name : Gentoo Security Advisory GLSA 201006-01 (freetype) File : nvt/glsa_201006_01.nasl
2010-05-12	Name : Mac OS X 10.5.7 Update / Mac OS X Security Update 2009-002 File : nvt/macosx_upd_10_5_7_secupd_2009-002.nasl
2009-10-13	Name : SLES10: Security update for freetype2 File : nvt/sles10_freetype21.nasl
2009-10-10	Name : SLES9: Security update for freetype2 File : nvt/sles9p5016218.nasl
2009-06-05	Name : Fedora Core 10 FEDORA-2009-5558 (freetype1) File : nvt/fcore_2009_5558.nasl
2009-06-05	Name : Fedora Core 11 FEDORA-2009-5644 (freetype1) File : nvt/fcore_2009_5644.nasl
2009-05-25	Name : RedHat Security Advisory RHSA-2009:1062 File : nvt/RHSA_2009_1062.nasl
2009-05-25	Name : CentOS Security Advisory CESA-2009:0329 (freetype) File : nvt/ovcesa2009_0329.nasl
2009-05-25	Name : RedHat Security Advisory RHSA-2009:0329 File : nvt/RHSA_2009_0329.nasl
2009-04-09	Name : Mandriva Update for freetype2 MDKSA-2007:121 (freetype2) File : nvt/gb_mandriva_MDKSA_2007_121.nasl
2009-03-23	Name : Ubuntu Update for freetype vulnerability USN-466-1 File : nvt/gb_ubuntu_USN_466_1.nasl
2009-02-27	Name : Fedora Update for freetype FEDORA-2007-0033 File : nvt/gb_fedora_2007_0033_freetype_fc7.nasl
2009-01-28	Name : SuSE Update for freetype2 SUSE-SA:2007:041 File : nvt/gb_suse_2007_041.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200705-22 (freetype) File : nvt/glsa_200705_22.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200707-02 (openoffice) File : nvt/glsa_200707_02.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200805-07 (ltsp) File : nvt/glsa_200805_07.nasl
2008-09-04	Name : FreeBSD Ports: freetype2 File : nvt/freebsd_freetype20.nasl
2008-01-17	Name : Debian Security Advisory DSA 1334-1 (freetype) File : nvt/deb_1334_1.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
36509	FreeType truetype/ttgload.c TTF Image Handling Overflow

Nessus® Vulnerability Scanner

Date	Description
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-0329.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0403.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090522_freetype_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20070611_freetype_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-01-04	Name : The remote server is affected by a signature validation bypass vulnerability. File : openssl_0_9_8j.nasl - Type : ACT_GATHER_INFO
2010-06-02	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201006-01.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_11554.nasl - Type : ACT_GATHER_INFO
2009-05-28	Name : The remote Fedora host is missing a security update. File : fedora_2009-5558.nasl - Type : ACT_GATHER_INFO
2009-05-28	Name : The remote Fedora host is missing a security update. File : fedora_2009-5644.nasl - Type : ACT_GATHER_INFO
2009-05-23	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-0329.nasl - Type : ACT_GATHER_INFO
2009-05-23	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1062.nasl - Type : ACT_GATHER_INFO
2009-05-23	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-0329.nasl - Type : ACT_GATHER_INFO
2009-05-13	Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2009-002.nasl - Type : ACT_GATHER_INFO
2008-05-11	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200805-07.nasl - Type : ACT_GATHER_INFO
2007-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_freetype2-3746.nasl - Type : ACT_GATHER_INFO
2007-11-10	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-466-1.nasl - Type : ACT_GATHER_INFO
2007-11-06	Name : The remote Fedora host is missing a security update. File : fedora_2007-0033.nasl - Type : ACT_GATHER_INFO
2007-10-17	Name : The remote openSUSE host is missing a security update. File : suse_freetype2-3744.nasl - Type : ACT_GATHER_INFO
2007-10-17	Name : The remote openSUSE host is missing a security update. File : suse_freetype2-3701.nasl - Type : ACT_GATHER_INFO
2007-07-23	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1334.nasl - Type : ACT_GATHER_INFO
2007-07-03	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200707-02.nasl - Type : ACT_GATHER_INFO
2007-06-14	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-121.nasl - Type : ACT_GATHER_INFO
2007-06-12	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0403.nasl - Type : ACT_GATHER_INFO
2007-06-12	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1302.nasl - Type : ACT_GATHER_INFO
2007-06-12	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0403.nasl - Type : ACT_GATHER_INFO
2007-06-01	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200705-22.nasl - Type : ACT_GATHER_INFO
2007-05-25	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_de2fab2d0a3711dcaae200304881ac9a.nasl - Type : ACT_GATHER_INFO
2007-02-18	Name : The remote host is missing Sun Security Patch number 119812-22 File : solaris10_119812.nasl - Type : ACT_GATHER_INFO
2007-02-18	Name : The remote host is missing Sun Security Patch number 119813-24 File : solaris10_x86_119813.nasl - Type : ACT_GATHER_INFO
2007-02-18	Name : The remote host is missing Sun Security Patch number 124420-04 File : solaris8_124420.nasl - Type : ACT_GATHER_INFO
2007-02-18	Name : The remote host is missing Sun Security Patch number 124421-04 File : solaris8_x86_124421.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
APPLE	http://lists.apple.com/archives/Security-announce/2007/Nov/msg00003.html http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
BID	http://www.securityfocus.com/bid/24074
BUGTRAQ	http://www.securityfocus.com/archive/1/469463/100/200/threaded http://www.securityfocus.com/archive/1/471286/30/6180/threaded
CERT	http://www.us-cert.gov/cas/techalerts/TA09-133A.html
CONFIRM	http://cvs.savannah.nongnu.org/viewvc/freetype2/src/truetype/ttgload.c?root=f... http://support.apple.com/kb/HT3549 http://support.avaya.com/elmodocs2/security/ASA-2007-330.htm https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=240200 https://bugzilla.redhat.com/show_bug.cgi?id=502565 https://issues.rpath.com/browse/RPL-1390
DEBIAN	http://www.debian.org/security/2007/dsa-1302 http://www.debian.org/security/2007/dsa-1334
FEDORA	https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01316.html https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01401.html
GENTOO	http://www.gentoo.org/security/en/glsa/glsa-200705-22.xml http://www.gentoo.org/security/en/glsa/glsa-200707-02.xml http://www.gentoo.org/security/en/glsa/glsa-200805-07.xml
MANDRIVA	http://www.mandriva.com/security/advisories?name=MDKSA-2007:121
MLIST	http://lists.gnu.org/archive/html/freetype-devel/2007-04/msg00041.html
OPENPKG	http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.018.html
OSVDB	http://osvdb.org/36509
OVAL	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova... https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
REDHAT	http://www.redhat.com/support/errata/RHSA-2007-0403.html http://www.redhat.com/support/errata/RHSA-2009-0329.html http://www.redhat.com/support/errata/RHSA-2009-1062.html
SECTRACK	http://www.securitytracker.com/id?1018088
SECUNIA	http://secunia.com/advisories/25350 http://secunia.com/advisories/25353 http://secunia.com/advisories/25386 http://secunia.com/advisories/25463 http://secunia.com/advisories/25483 http://secunia.com/advisories/25609 http://secunia.com/advisories/25612 http://secunia.com/advisories/25654 http://secunia.com/advisories/25705 http://secunia.com/advisories/25808 http://secunia.com/advisories/25894 http://secunia.com/advisories/25905 http://secunia.com/advisories/26129 http://secunia.com/advisories/26305 http://secunia.com/advisories/28298 http://secunia.com/advisories/30161 http://secunia.com/advisories/35074 http://secunia.com/advisories/35200 http://secunia.com/advisories/35204 http://secunia.com/advisories/35233
SGI	ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc
SUNALERT	http://sunsolve.sun.com/search/document.do?assetkey=1-26-102967-1 http://sunsolve.sun.com/search/document.do?assetkey=1-26-103171-1 http://sunsolve.sun.com/search/document.do?assetkey=1-66-200033-1
SUSE	http://www.novell.com/linux/security/advisories/2007_41_freetype2.html
TRUSTIX	http://www.trustix.org/errata/2007/0019/
UBUNTU	http://www.ubuntu.com/usn/usn-466-1
VUPEN	http://www.vupen.com/english/advisories/2007/1894 http://www.vupen.com/english/advisories/2007/2229 http://www.vupen.com/english/advisories/2008/0049 http://www.vupen.com/english/advisories/2009/1297

Alert History

If you want to see full details history, please login or register.

Date	Informations
2024-02-02 01:06:34	Multiple Updates
2024-02-01 12:02:18	Multiple Updates
2023-09-05 12:06:08	Multiple Updates
2023-09-05 01:02:09	Multiple Updates
2023-09-02 12:06:14	Multiple Updates
2023-09-02 01:02:09	Multiple Updates
2023-08-12 12:07:15	Multiple Updates
2023-08-12 01:02:10	Multiple Updates
2023-08-11 12:06:17	Multiple Updates
2023-08-11 01:02:14	Multiple Updates
2023-08-06 12:05:59	Multiple Updates
2023-08-06 01:02:10	Multiple Updates
2023-08-04 12:06:05	Multiple Updates
2023-08-04 01:02:13	Multiple Updates
2023-07-14 12:06:03	Multiple Updates
2023-07-14 01:02:11	Multiple Updates
2023-03-29 01:06:47	Multiple Updates
2023-03-28 12:02:17	Multiple Updates
2023-02-13 09:29:27	Multiple Updates
2023-02-02 21:28:59	Multiple Updates
2022-10-11 12:05:22	Multiple Updates
2022-10-11 01:02:02	Multiple Updates
2021-05-04 12:05:48	Multiple Updates
2021-04-22 01:06:22	Multiple Updates
2021-01-27 12:03:13	Multiple Updates
2021-01-27 01:02:55	Multiple Updates
2020-05-23 01:38:14	Multiple Updates
2020-05-23 00:19:48	Multiple Updates
2018-10-16 21:19:57	Multiple Updates
2017-10-11 09:23:58	Multiple Updates
2016-06-28 16:30:45	Multiple Updates
2016-04-26 16:09:17	Multiple Updates
2014-02-17 10:40:13	Multiple Updates
2013-05-11 10:25:58	Multiple Updates
2012-11-07 05:19:02	Multiple Updates

Global Informations

Type	Count
Oval ID(s)	4
CPE ID(s)	32
Sources(s)	60
osvdb(s)	1
Openvas Exploit(s)	19
Nessus® Exploit(s)	31

	Related
10	TA09-133A
10	RHSA-2009:1062
10	RHSA-2009:0329
10	GLSA-200805-07
7.5	GLSA-201006-01
6.8	USN-466-1
6.8	SUN-103171
6.8	RHSA-2007:0403
6.8	DSA-1302
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 9 more Alert(s)

6.8 - CVE-2007-2754

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Nessus® Vulnerability Scanner

Sources (Detail)

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU