Security update for freetype2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2025:20204-1 Final 1 1 2025-04-24T14:44:51Z current 2025-04-24T14:44:51Z 2025-04-24T14:44:51Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for freetype2 This update for freetype2 fixes the following issues: Update to 2.13.2: * Some fields in the `FT_Outline` structure have been changed from signed to unsigned type, which better reflects the actual usage. It is also an additional means to protect against malformed input. * Rare double-free crashes in the cache subsystem have been fixed. * Excessive stack allocation in the autohinter has been fixed. * The B/W rasterizer has received a major upkeep that results in large performance improvements. The rendering speed has increased and even doubled for very complex glyphs. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Micro-6.0-300 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2025/suse-su-202520204-1/ Link for SUSE-SU-2025:20204-1 https://lists.suse.com/pipermail/sle-security-updates/2025-June/021136.html E-Mail link for SUSE-SU-2025:20204-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1035807 SUSE Bug 1035807 https://bugzilla.suse.com/1036457 SUSE Bug 1036457 https://bugzilla.suse.com/1079600 SUSE Bug 1079600 https://bugzilla.suse.com/1198823 SUSE Bug 1198823 https://bugzilla.suse.com/1198830 SUSE Bug 1198830 https://bugzilla.suse.com/1198832 SUSE Bug 1198832 https://bugzilla.suse.com/867620 SUSE Bug 867620 https://www.suse.com/security/cve/CVE-2014-2240/ SUSE CVE CVE-2014-2240 page https://www.suse.com/security/cve/CVE-2014-2241/ SUSE CVE CVE-2014-2241 page https://www.suse.com/security/cve/CVE-2017-8105/ SUSE CVE CVE-2017-8105 page https://www.suse.com/security/cve/CVE-2017-8287/ SUSE CVE CVE-2017-8287 page https://www.suse.com/security/cve/CVE-2022-27404/ SUSE CVE CVE-2022-27404 page https://www.suse.com/security/cve/CVE-2022-27405/ SUSE CVE CVE-2022-27405 page https://www.suse.com/security/cve/CVE-2022-27406/ SUSE CVE CVE-2022-27406 page SUSE Linux Micro 6.0 libfreetype6-2.13.3-1.1 libfreetype6-2.13.3-1.1 as a component of SUSE Linux Micro 6.0 Stack-based buffer overflow in the cf2_hintmap_build function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of stem hints in a font file. CVE-2014-2240 SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202520204-1/ https://www.suse.com/security/cve/CVE-2014-2240.html CVE-2014-2240 https://bugzilla.suse.com/867620 SUSE Bug 867620 https://bugzilla.suse.com/916867 SUSE Bug 916867 The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service (assertion failure), as demonstrated by a crafted ttf file. CVE-2014-2241 SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202520204-1/ https://www.suse.com/security/cve/CVE-2014-2241.html CVE-2014-2241 https://bugzilla.suse.com/867620 SUSE Bug 867620 FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c. CVE-2017-8105 SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1 important 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202520204-1/ https://www.suse.com/security/cve/CVE-2017-8105.html CVE-2017-8105 https://bugzilla.suse.com/1034186 SUSE Bug 1034186 https://bugzilla.suse.com/1035807 SUSE Bug 1035807 https://bugzilla.suse.com/1036457 SUSE Bug 1036457 https://bugzilla.suse.com/1079459 SUSE Bug 1079459 FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c. CVE-2017-8287 SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1 important 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202520204-1/ https://www.suse.com/security/cve/CVE-2017-8287.html CVE-2017-8287 https://bugzilla.suse.com/1034186 SUSE Bug 1034186 https://bugzilla.suse.com/1035807 SUSE Bug 1035807 https://bugzilla.suse.com/1036457 SUSE Bug 1036457 https://bugzilla.suse.com/1079459 SUSE Bug 1079459 FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face. CVE-2022-27404 SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202520204-1/ https://www.suse.com/security/cve/CVE-2022-27404.html CVE-2022-27404 https://bugzilla.suse.com/1198830 SUSE Bug 1198830 FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request. CVE-2022-27405 SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202520204-1/ https://www.suse.com/security/cve/CVE-2022-27405.html CVE-2022-27405 https://bugzilla.suse.com/1198832 SUSE Bug 1198832 FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size. CVE-2022-27406 SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202520204-1/ https://www.suse.com/security/cve/CVE-2022-27406.html CVE-2022-27406 https://bugzilla.suse.com/1198823 SUSE Bug 1198823