Vulnerability Description
Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF Type2 CharStrings interpreter in cff/cffgload.c in FreeType before 2.4.2, as used in Apple iOS before 4.0.2 on the iPhone and iPod touch and before 3.2.2 on the iPad, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted CFF opcodes in embedded fonts in a PDF document, as demonstrated by JailbreakMe. NOTE: some of these details are obtained from third party information.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apple | Iphone Os | 1.0.0 |
Related Weaknesses (CWE)
References
- http://freetype.sourceforge.net/index2.html#release-freetype-2.4.2
- http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=018f5c27813dd
- http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=11d65e8a1f1f1
- http://lists.apple.com/archives/security-announce/2010//Aug/msg00000.html
- http://lists.apple.com/archives/security-announce/2010//Aug/msg00001.htmlVendor Advisory
- http://osvdb.org/66828
- http://secunia.com/advisories/40807Vendor Advisory
- http://secunia.com/advisories/40816Vendor Advisory
- http://secunia.com/advisories/40982Vendor Advisory
- http://secunia.com/advisories/48951
- http://sourceforge.net/projects/freetype/files/freetype2/2.4.2/NEWS/view
- http://support.apple.com/kb/HT4291Vendor Advisory
- http://support.apple.com/kb/HT4292Vendor Advisory
- http://www.exploit-db.com/exploits/14538Exploit
- http://www.f-secure.com/weblog/archives/00002002.html
FAQ
What is CVE-2010-1797?
CVE-2010-1797 is a vulnerability with a CVSS score of 9.3 (HIGH). Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF Type2 CharStrings interpreter in cff/cffgload.c in FreeType before 2.4.2, as used in Apple iOS before 4.0...
How severe is CVE-2010-1797?
CVE-2010-1797 has been rated HIGH with a CVSS base score of 9.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-1797?
Check the references section above for vendor advisories and patch information. Affected products include: Apple Iphone Os.