CVE-2007-2754

Public Exploit

Description

Integer signedness error in truetype/ttgload.c in Freetype 2.3.4 and earlier might allow remote attackers to execute arbitrary code via a crafted TTF image with a negative n_points value, which leads to an integer overflow and heap-based buffer overflow.

6.8

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 47.44% Top 5%

Vendor Advisory debian.org Vendor Advisory sun.com Vendor Advisory debian.org Vendor Advisory novell.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory apple.com Vendor Advisory mandriva.com Vendor Advisory sun.com Vendor Advisory redhat.com Vendor Advisory apple.com Vendor Advisory gentoo.org Vendor Advisory gentoo.org Vendor Advisory trustix.org Vendor Advisory openpkg.com Vendor Advisory sun.com Vendor Advisory gentoo.org Vendor Advisory sgi.com Vendor Advisory ubuntu.com Vendor Advisory redhat.com

Affected: n/a n/a

References

Link	Tags
http://www.vupen.com/english/advisories/2007/2229	vdb entry
http://secunia.com/advisories/26129	third party advisory
http://support.avaya.com/elmodocs2/security/ASA-2007-330.htm
http://secunia.com/advisories/25612	third party advisory
https://issues.rpath.com/browse/RPL-1390
http://www.vupen.com/english/advisories/2008/0049	vdb entry
http://secunia.com/advisories/25894	third party advisory
http://www.debian.org/security/2007/dsa-1334	vendor advisory
http://secunia.com/advisories/25386	third party advisory
http://secunia.com/advisories/28298	third party advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-103171-1	vendor advisory
http://secunia.com/advisories/25705	third party advisory
http://support.apple.com/kb/HT3549
http://cvs.savannah.nongnu.org/viewvc/freetype2/src/truetype/ttgload.c?root=freetype&r1=1.177&r2=1.178	patch
http://www.debian.org/security/2007/dsa-1302	vendor advisory
http://osvdb.org/36509	vdb entry
http://www.novell.com/linux/security/advisories/2007_41_freetype2.html	vendor advisory
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01401.html	vendor advisory
http://secunia.com/advisories/35074	third party advisory
http://secunia.com/advisories/26305	third party advisory
http://www.securityfocus.com/archive/1/471286/30/6180/threaded	mailing list
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01316.html	vendor advisory
http://www.securityfocus.com/bid/24074	vdb entry
http://www.redhat.com/support/errata/RHSA-2009-1062.html	vendor advisory
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html	vendor advisory
http://secunia.com/advisories/25463	third party advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:121	vendor advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200033-1	vendor advisory
http://www.redhat.com/support/errata/RHSA-2007-0403.html	vendor advisory
http://lists.apple.com/archives/Security-announce/2007/Nov/msg00003.html	vendor advisory
http://secunia.com/advisories/25353	third party advisory
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=240200	exploit
http://secunia.com/advisories/30161	third party advisory
http://www.gentoo.org/security/en/glsa/glsa-200805-07.xml	vendor advisory
http://www.gentoo.org/security/en/glsa/glsa-200707-02.xml	vendor advisory
http://www.trustix.org/errata/2007/0019/	vendor advisory
https://bugzilla.redhat.com/show_bug.cgi?id=502565
http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.018.html	vendor advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102967-1	vendor advisory
http://lists.gnu.org/archive/html/freetype-devel/2007-04/msg00041.html	exploit mailing list
http://www.us-cert.gov/cas/techalerts/TA09-133A.html	third party advisory us government resource
http://secunia.com/advisories/25808	third party advisory
http://www.gentoo.org/security/en/glsa/glsa-200705-22.xml	vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5532	signature vdb entry
http://www.vupen.com/english/advisories/2009/1297	vdb entry
http://secunia.com/advisories/25609	third party advisory
http://secunia.com/advisories/35233	third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11325	signature vdb entry
http://secunia.com/advisories/35200	third party advisory
http://secunia.com/advisories/25350	third party advisory
ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc	vendor advisory
http://www.ubuntu.com/usn/usn-466-1	vendor advisory
http://www.vupen.com/english/advisories/2007/1894	vdb entry
http://www.redhat.com/support/errata/RHSA-2009-0329.html	vendor advisory
http://secunia.com/advisories/25905	third party advisory
http://secunia.com/advisories/35204	third party advisory
http://secunia.com/advisories/25654	third party advisory
http://secunia.com/advisories/25483	third party advisory
http://www.securitytracker.com/id?1018088	vdb entry
http://www.securityfocus.com/archive/1/469463/100/200/threaded	mailing list

Frequently Asked Questions

What is the severity of CVE-2007-2754?: CVE-2007-2754 has been scored as a medium severity vulnerability.
How to fix CVE-2007-2754?: To fix CVE-2007-2754, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2007-2754 being actively exploited in the wild?: It is possible that CVE-2007-2754 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~47% probability that this vulnerability will be exploited by malicious actors in the next 30 days.