CVE-2014-9671

Name of the Vulnerable Software and Affected Versions FreeType versions prior to 2.5.4

Description The issue is related to an off-by-one error in the pcf get properties function, which can be exploited by remote attackers to cause a denial of service. This is achieved by crafting a PCF file with a size value of 0xffffffff, which is improperly incremented. The result is a NULL pointer dereference and application crash.

Recommendations For versions prior to 2.5.4, update to version 2.5.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted PCF files to minimize the risk of exploitation.