The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9660
Reference (s):
- BID:72986
- URL: http://www.securityfocus.com/bid/72986
- http://advisories.mageia.org/MGASA-2015-0083.html
- http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=af8346172a7b573715134f7a51e6c5c60fa7f2ab
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html