CVE-2014-9670

Name of the Vulnerable Software and Affected Versions FreeType versions prior to 2.5.4

Description The issue is caused by multiple integer signedness errors in the pcf get encodings function, allowing remote attackers to cause a denial of service, including integer overflow, NULL pointer dereference, and application crash, via a crafted PCF file that specifies negative values for the first column and first row.

Recommendations For versions prior to 2.5.4, update to version 2.5.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted PCF files to minimize the risk of exploitation.