CVE-2011-0226

Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Type 1 font in a PDF document, as exploited in the wild in July 2011.

Affected Software

Name	Vendor	Start Version	End Version
Freetype	Freetype	*	2.4.5 (including)
Freetype	Freetype	2.2.1 (including)	2.2.1 (including)
Freetype	Freetype	2.2.10 (including)	2.2.10 (including)
Freetype	Freetype	2.3.0 (including)	2.3.0 (including)
Freetype	Freetype	2.3.1 (including)	2.3.1 (including)
Freetype	Freetype	2.3.2 (including)	2.3.2 (including)
Freetype	Freetype	2.3.3 (including)	2.3.3 (including)
Freetype	Freetype	2.3.4 (including)	2.3.4 (including)
Freetype	Freetype	2.3.5 (including)	2.3.5 (including)
Freetype	Freetype	2.3.6 (including)	2.3.6 (including)
Freetype	Freetype	2.3.7 (including)	2.3.7 (including)
Freetype	Freetype	2.3.8 (including)	2.3.8 (including)
Freetype	Freetype	2.3.9 (including)	2.3.9 (including)
Freetype	Freetype	2.3.10 (including)	2.3.10 (including)
Freetype	Freetype	2.3.11 (including)	2.3.11 (including)
Freetype	Freetype	2.3.12 (including)	2.3.12 (including)
Freetype	Freetype	2.4.0 (including)	2.4.0 (including)
Freetype	Freetype	2.4.1 (including)	2.4.1 (including)
Freetype	Freetype	2.4.2 (including)	2.4.2 (including)
Freetype	Freetype	2.4.3 (including)	2.4.3 (including)
Freetype	Freetype	2.4.4 (including)	2.4.4 (including)
Red Hat Enterprise Linux 6	RedHat	freetype-0:2.3.11-6.el6_1.6	*
Freetype	Ubuntu	devel	*
Freetype	Ubuntu	maverick	*
Freetype	Ubuntu	natty	*
Freetype	Ubuntu	upstream	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2011-0226
CWE	https://cwe.mitre.org/data/definitions/189.html

Affected Software

References