CVE:CVE-2009-0946
CNNVD:CNNVD-200904-345
FreeType是一款使用C语言编写的开源字体渲染库。
FreeType库的cff/cffload.c文件中的cff_charset_compute_cids()函数、smooth/ftsmooth.c文件中的ft_smooth_render_generic()函数及sfnt/ttcmap.c文件中的多个验证函数存在输入验证错误漏洞。如果用户受骗打开了畸形的字体文件的话，就可能触发这些溢出，导致执行任意代码。
solution:Upgrade freetype freetype to a higher version than 2.3.9,and avoid the version (,2.3.9]; Upgrade debian debian_linux to a higher version than 4.0,5.0,6.0,and avoid the version 4.0,5.0,6.0; Upgrade canonical ubuntu_linux to a higher version than 6.06,8.04,8.10,9.04,and avoid the version 6.06,8.04,8.10,9.04; Upgrade opensuse opensuse to a higher version than 10.3,11.0,11.1,and avoid the version 10.3,11.0,11.1; Upgrade suse linux_enterprise_server to a higher version than 10,11,and avoid the version 10,11; Upgrade apple safari to a higher version than 4.0,and avoid the version 4.0; Upgrade apple iphone_os to a higher version than 2.2.1,and avoid the version [1.0.0,2.2.1]; Upgrade apple mac_os_x to a higher version than 10.6.4,10.4.11,10.5.8,and avoid the version [10.6.0,10.6.4],10.4.11,10.5.8; Upgrade apple mac_os_x_server to a higher version than 10.6.4,10.4.11,10.5.8,and avoid the version [10.6.0,10.6.4],10.4.11,10.5.8