CVE-2014-9663

Name of the Vulnerable Software and Affected Versions FreeType versions prior to 2.5.4

Description The issue is related to the tt cmap4 validate function in sfnt/ttcmap.c, which validates a certain length field before its value is completely calculated. This allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table.

Recommendations For versions prior to 2.5.4, update to version 2.5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to crafted cmap SFNT tables to minimize the risk of exploitation.