CVE-2010-3054 Denial of service in n/a

What is CVE-2010-3054?

CVE-2010-3054 is a medium-severity denial of service vulnerability in Freetype Freetype, published on 19 Aug 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Unspecified vulnerability in FreeType 2.3.9, and other versions before 2.4.2, allows remote attackers to cause a denial of service via vectors involving nested Standard Encoding Accented Character (aka seac) calls, related to psaux.h, cffgload.c, cffgload.h, and t1decode.c.

Which versions are affected by CVE-2010-3054?

It affects 1 product.

Products include Freetype Freetype.

How do I fix CVE-2010-3054?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2010-3054 being exploited?

There is no known exploitation of CVE-2010-3054 in the wild and no public exploit code.

Other vulnerabilities in Freetype Freetype

• CVE-2012-1126 Memory corruption in n/a Critical 10.0
• CVE-2015-9290 Memory corruption in n/a Critical 9.8
• CVE-2017-8287 Memory corruption in n/a Critical 9.8
• CVE-2016-10328 Memory corruption in n/a Critical 9.8
• CVE-2017-7857 Memory corruption in n/a Critical 9.8

All Freetype Freetype vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2010-3054, GHSA-ppwg-2jjq-44w4.