CVE-2016-10244

Name of the Vulnerable Software and Affected Versions FreeType versions prior to 2.7

Description The issue is related to the parse charstrings function in type1/t1load.c, which does not ensure that a font contains a glyph name. This allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file. The exploitation of this issue may lead to a denial of service or other unspecified effects.

Recommendations For versions prior to 2.7, update to version 2.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the parse charstrings function in type1/t1load.c until a patch is available. Avoid using crafted files that may exploit this issue until the update is applied.