CVE-2008-1807: freetype Numeric Errors

CVSS: 7.5v2.0HighModified

AliasesDEBIAN-CVE-2008-1807

Published 16-06-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-1807 is a high (CVSS 7.5) Numeric Errors vulnerability in freetype. EPSS estimates a 3.58% chance of exploitation in the next 30 days, higher than 89.2% of scored vulnerabilities.

Overall risk

31/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

3.58%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4

DSA-1635-1 DTSA-139-1 RHSA-2008:0556 RHSA-2008:0558

Timeline

16-06-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via an invalid "number of axes" field in a Printer Font Binary (PFB) file, which triggers a free of arbitrary memory locations, leading to memory corruption.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

3.58%

Chance of exploitation in the next 30 days

Percentile

89%

Versus all other CVEs

30-day change

0.00 pp

From 3.58% on 19-09-2026

19-09-202619-10-2026

EPSS score

3.58%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-189Numeric ErrorsWeaknesses in this category are related to improper calculation or conversion of numbers.

Affected systems

Debian1 product

freetype< 2.3.6-1

Freetype1 product

freetype1.3.1 | 2.3.3 | 2.3.4 | 2.3.5

2 vendors · 2 products

References

57 links

www.securityfocus.com/archive/1/495497/100/0/threadedMailing ListX Refsource BUGTRAQ
security.gentoo.org/glsa/glsa-201209-25.xmlVendor AdvisoryX Refsource GENTOO
www.securityfocus.com/bid/29641VDB EntryX Refsource BID
www.vmware.com/security/advisories/VMSA-2008-0014.htmlX Refsource CONFIRM
www.redhat.com/archives/fedora-package-announce/2008-June/msg00721.htmlVendor AdvisoryX Refsource FEDORA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9767VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/33937Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/1876/referencesVDB EntryX Refsource VUPEN
secunia.com/advisories/30721Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDVSA-2008:121Vendor AdvisoryX Refsource MANDRIVA

Show all 57 references

securitytracker.com/id?1020239VDB EntryX Refsource SECTRACK
www.vupen.com/english/advisories/2008/2525VDB EntryX Refsource VUPEN
secunia.com/advisories/31712Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/31709Third Party AdvisoryX Refsource SECUNIA
sourceforge.net/project/shownotes.php?group_id=3157&release_id=605780X Refsource MISC
www.vmware.com/support/server/doc/releasenotes_server.htmlX Refsource CONFIRM
secunia.com/advisories/30740Third Party AdvisoryX Refsource SECUNIA
support.apple.com/kb/HT3438X Refsource CONFIRM
security.gentoo.org/glsa/glsa-200806-10.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/30766Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/31479Third Party AdvisoryX Refsource SECUNIA
lists.apple.com/archives/security-announce/2009/Feb/msg00000.htmlVendor AdvisoryX Refsource APPLE
www.vupen.com/english/advisories/2008/2423VDB EntryX Refsource VUPEN
www.vmware.com/support/player2/doc/releasenotes_player2.htmlX Refsource CONFIRM
secunia.com/advisories/30967Third Party AdvisoryX Refsource SECUNIA
sunsolve.sun.com/search/document.do?assetkey=1-26-239006-1Vendor AdvisoryX Refsource SUNALERT
issues.rpath.com/browse/RPL-2608X Refsource CONFIRM
secunia.com/advisories/30821Third Party AdvisoryX Refsource SECUNIA
support.apple.com/kb/HT3026X Refsource CONFIRM
support.apple.com/kb/HT3129X Refsource CONFIRM
www.vmware.com/support/player/doc/releasenotes_player.htmlX Refsource CONFIRM
www.redhat.com/archives/fedora-package-announce/2008-June/msg00717.htmlVendor AdvisoryX Refsource FEDORA
www.vmware.com/support/ws6/doc/releasenotes_ws6.htmlX Refsource CONFIRM
secunia.com/advisories/31856Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/archive/1/495869/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/31711Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2008-0556.htmlVendor AdvisoryX Refsource REDHAT
lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.htmlVendor AdvisoryX Refsource SUSE
wiki.rpath.com/wiki/Advisories:rPSA-2008-0255X Refsource CONFIRM
labs.idefense.com/intelligence/vulnerabilities/display.php?id=716Third Party AdvisoryX Refsource IDEFENSE
lists.apple.com/archives/security-announce//2008/Sep/msg00004.htmlVendor AdvisoryX Refsource APPLE
lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.htmlMailing ListX Refsource FULLDISC
www.vupen.com/english/advisories/2008/1794VDB EntryX Refsource VUPEN
secunia.com/advisories/31823Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/2558VDB EntryX Refsource VUPEN
secunia.com/advisories/30600Third Party AdvisoryX Refsource SECUNIAVendor Advisory
support.avaya.com/elmodocs2/security/ASA-2008-318.htmX Refsource CONFIRM
www.vmware.com/support/ws55/doc/releasenotes_ws55.htmlX Refsource CONFIRM
secunia.com/advisories/31900Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/30819Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/31707Third Party AdvisoryX Refsource SECUNIA
lists.apple.com/archives/security-announce//2008/Sep/msg00003.htmlVendor AdvisoryX Refsource APPLE
www.ubuntu.com/usn/usn-643-1Vendor AdvisoryX Refsource UBUNTU
www.redhat.com/support/errata/RHSA-2008-0558.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/31577Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/2466VDB EntryX Refsource VUPEN
security-tracker.debian.org/tracker/CVE-2008-1807Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities