Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2009-0946 Details

Description

Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0545ec1ca36b27cb928128870a83e5f668980bc5	CVE	PatchThird Party Advisory
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=79972af4f0485a11dcb19551356c45245749fc5b	CVE	PatchThird Party Advisory
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=a18788b14db60ae3673f932249cd02d33a227c4e	CVE	PatchThird Party Advisory
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/ChangeLog	CVE	Release NotesThird Party Advisory
http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html	CVE	Broken Link
http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html	CVE	Mailing ListThird Party Advisory
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html	CVE	Mailing ListThird Party Advisory
http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html	CVE	Mailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html	CVE	Mailing ListThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=491384	CVE	Issue TrackingPatchThird Party Advisory
http://secunia.com/advisories/34723	CVE	Third Party Advisory
http://secunia.com/advisories/34913	CVE	Third Party Advisory
http://secunia.com/advisories/34967	CVE	Third Party Advisory
http://secunia.com/advisories/35065	CVE	Third Party Advisory
http://secunia.com/advisories/35074	CVE	Third Party Advisory
http://secunia.com/advisories/35198	CVE	Third Party Advisory
http://secunia.com/advisories/35200	CVE	Third Party Advisory
http://secunia.com/advisories/35204	CVE	Third Party Advisory
http://secunia.com/advisories/35210	CVE	Third Party Advisory
http://secunia.com/advisories/35379	CVE	Third Party Advisory
http://security.gentoo.org/glsa/glsa-200905-05.xml	CVE	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10149	CVE	Third Party Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-270268-1	CVE	Broken Link
http://support.apple.com/kb/HT3549	CVE	Third Party Advisory
http://support.apple.com/kb/HT3613	CVE	Third Party Advisory
http://support.apple.com/kb/HT3639	CVE	Third Party Advisory
http://support.apple.com/kb/HT4435	CVE	Broken Link
http://www.debian.org/security/2009/dsa-1784	CVE	Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:243	CVE	Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2009-0329.html	CVE	Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2009-1061.html	CVE	Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2009-1062.html	CVE	Third Party Advisory
http://www.securityfocus.com/bid/34550	CVE	Third Party AdvisoryVDB Entry
http://www.ubuntu.com/usn/USN-767-1	CVE	Third Party Advisory
http://www.us-cert.gov/cas/techalerts/TA09-133A.html	CVE	Third Party AdvisoryUS Government Resource
http://www.vupen.com/english/advisories/2009/1058	CVE	Third Party Advisory
http://www.vupen.com/english/advisories/2009/1297	CVE	Third Party Advisory
http://www.vupen.com/english/advisories/2009/1522	CVE	Third Party Advisory
http://www.vupen.com/english/advisories/2009/1621	CVE	Third Party Advisory
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0545ec1ca36b27cb928128870a83e5f668980bc5	[email protected]	PatchThird Party Advisory
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=79972af4f0485a11dcb19551356c45245749fc5b	[email protected]	PatchThird Party Advisory
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=a18788b14db60ae3673f932249cd02d33a227c4e	[email protected]	PatchThird Party Advisory
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/ChangeLog	[email protected]	Release NotesThird Party Advisory
http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html	[email protected]	Broken Link
http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html	[email protected]	Mailing ListThird Party Advisory
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html	[email protected]	Mailing ListThird Party Advisory
http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html	[email protected]	Mailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html	[email protected]	Mailing ListThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=491384	[email protected]	Issue TrackingPatchThird Party Advisory
http://secunia.com/advisories/34723	[email protected]	Third Party Advisory
http://secunia.com/advisories/34913	[email protected]	Third Party Advisory
http://secunia.com/advisories/34967	[email protected]	Third Party Advisory
http://secunia.com/advisories/35065	[email protected]	Third Party Advisory
http://secunia.com/advisories/35074	[email protected]	Third Party Advisory
http://secunia.com/advisories/35198	[email protected]	Third Party Advisory
http://secunia.com/advisories/35200	[email protected]	Third Party Advisory
http://secunia.com/advisories/35204	[email protected]	Third Party Advisory
http://secunia.com/advisories/35210	[email protected]	Third Party Advisory
http://secunia.com/advisories/35379	[email protected]	Third Party Advisory
http://security.gentoo.org/glsa/glsa-200905-05.xml	[email protected]	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10149	[email protected]	Third Party Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-270268-1	[email protected]	Broken Link
http://support.apple.com/kb/HT3549	[email protected]	Third Party Advisory
http://support.apple.com/kb/HT3613	[email protected]	Third Party Advisory
http://support.apple.com/kb/HT3639	[email protected]	Third Party Advisory
http://support.apple.com/kb/HT4435	[email protected]	Broken Link
http://www.debian.org/security/2009/dsa-1784	[email protected]	Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:243	[email protected]	Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2009-0329.html	[email protected]	Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2009-1061.html	[email protected]	Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2009-1062.html	[email protected]	Third Party Advisory
http://www.securityfocus.com/bid/34550	[email protected]	Third Party AdvisoryVDB Entry
http://www.ubuntu.com/usn/USN-767-1	[email protected]	Third Party Advisory
http://www.us-cert.gov/cas/techalerts/TA09-133A.html	[email protected]	Third Party AdvisoryUS Government Resource
http://www.vupen.com/english/advisories/2009/1058	[email protected]	Third Party Advisory
http://www.vupen.com/english/advisories/2009/1297	[email protected]	Third Party Advisory
http://www.vupen.com/english/advisories/2009/1522	[email protected]	Third Party Advisory
http://www.vupen.com/english/advisories/2009/1621	[email protected]	Third Party Advisory

see all 78 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-190	Integer Overflow or Wraparound	[email protected]

Affected Products

Product	Versions
freetype freetype	<= 2.3.9
CPE cpe:2.3:a:freetype:freetype:::::::: Remediation No remediation found in references.
debian debian linux	4.0 5.0 6.0
CPE cpe:2.3:o:debian:debian_linux:4.0:::::::* cpe:2.3:o:debian:debian_linux:5.0:::::::* cpe:2.3:o:debian:debian_linux:6.0:::::::* Remediation No remediation found in references.
canonical ubuntu linux	6.06 8.04 8.10 9.04
CPE cpe:2.3:o:canonical:ubuntu_linux:6.06:::::::* cpe:2.3:o:canonical:ubuntu_linux:8.04::::-::: cpe:2.3:o:canonical:ubuntu_linux:8.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:9.04:::::::* Remediation No remediation found in references.
opensuse opensuse	10.3 11.0 11.1
CPE cpe:2.3:o:opensuse:opensuse:10.3:::::::* cpe:2.3:o:opensuse:opensuse:11.0:::::::* cpe:2.3:o:opensuse:opensuse:11.1:::::::* Remediation No remediation found in references.
suse linux enterprise server	10 - 11 -
CPE cpe:2.3:o:suse:linux_enterprise_server:10:-:::::: cpe:2.3:o:suse:linux_enterprise_server:11:-:::::: Remediation No remediation found in references.
apple safari	4.0
CPE cpe:2.3:a:apple:safari:4.0:::::::* Remediation No remediation found in references.
apple iphone os	>= 1.0.0, <= 2.2.1
CPE cpe:2.3:o:apple:iphone_os:::::::: Remediation No remediation found in references.
apple mac os x	>= 10.6.0, <= 10.6.4 10.4.11 10.5.8
CPE cpe:2.3:o:apple:mac_os_x:::::::: cpe:2.3:o:apple:mac_os_x:10.4.11:::::::* cpe:2.3:o:apple:mac_os_x:10.5.8:::::::* Remediation No remediation found in references.
apple mac os x server	>= 10.6.0, <= 10.6.4 10.4.11 10.5.8
CPE cpe:2.3:o:apple:mac_os_x_server:::::::: cpe:2.3:o:apple:mac_os_x_server:10.4.11:::::::* cpe:2.3:o:apple:mac_os_x_server:10.5.8:::::::* Remediation No remediation found in references.

Change History

9 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Apr 23, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Apr 5, 2021	Modified Analysis	[email protected]
Jan 26, 2021	CPE Deprecation Remap	[email protected]
Jan 26, 2021	CPE Deprecation Remap	[email protected]
Sep 29, 2017	CVE Modified	[email protected]
Apr 17, 2009	Initial Analysis	[email protected]

CVE-2009-0946 Details

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

Change History

QUICK INFO