CVE-2010-3311

Loading...

General

Score:9.3/10.0
Severity:High
Category:Numeric Error

Impact Metrics

Confidentiality:Complete
Integrity:Complete
Availability:Complete

Exploitability Metrics

Access Vector:Network
Access Complexity:Medium
Authentication:None

Relative vulnerabilities

CVE-2010-1797, CVE-2010-2497, CVE-2010-2498, CVE-2010-2499, CVE-2010-2500, CVE-2010-2519, CVE-2010-2520, CVE-2010-2527, CVE-2010-2541, CVE-2010-2805, CVE-2010-2806, CVE-2010-2808, CVE-2010-3053, CVE-2010-3054, CVE-2010-3814, CVE-2010-3855, CVE-2011-2895, CVE-2011-3256, CVE-2011-3439, CVE-2012-1126, CVE-2012-1127, CVE-2012-1129, CVE-2012-1130, CVE-2012-1131, CVE-2012-1132, CVE-2012-1133, CVE-2012-1134, CVE-2012-1135, CVE-2012-1136, CVE-2012-1137, CVE-2012-1138, CVE-2012-1139, CVE-2012-1141, CVE-2012-1142, CVE-2012-1143

Published on 08/01/11 - Updated on 19/12/12

Description

Integer overflow in base/ftstream.c in libXft (aka the X FreeType library) in FreeType before 2.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Compact Font Format (CFF) font file that triggers a heap-based buffer overflow, related to an "input stream position error" issue, a different vulnerability than CVE-2010-1797.

Category: Numeric Error

CWE-189 (Numeric Errors)
Weaknesses in this category are related to improper calculation or conversion of numbers.

Security Notices

US National Vulnerability DatabaseCVE-2010-3311
CentOS CESA-2010:0737
Oracle Linux ELSA-2010-0889
Redhat RHSA-2010:0737, RHSA-2010:0864
SUSE SUSE-SU-2012:0553

Exploits

No exploits available for this CVE in our database.

Relative technologies

VendorProduct
freetypefreetype

Share this vulnerability with:

Twitter Facebook LinkedIn Mail