The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field’s value is completely calculated, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9663
Reference (s):
- BID:72986
- URL: http://www.securityfocus.com/bid/72986
- http://advisories.mageia.org/MGASA-2015-0083.html
- http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=9bd20b7304aae61de5d50ac359cf27132bafd4c1
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html