CVE-2014-9675: canonical ubuntu_linux
CVSS: 5.0v2.0MediumModified
AliasesUBUNTU-CVE-2014-9675DEBIAN-CVE-2014-9675
Published 08-02-2015Last modified 06-08-2024
Vulnerability summary
CVE-2014-9675 is a medium (CVSS 5.0) vulnerability in canonical ubuntu_linux. EPSS estimates a 4.16% chance of exploitation in the next 30 days, higher than 90.7% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
5.0/10
010
Medium · v2.0 (NVD)EPSS score
4.16%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 8 · Related 4Timeline
- 08-02-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font.
CVSS metrics
1 score · 1 source · 1 versionMedium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
4.16%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
0.00 pp
From 4.16% on 19-09-2026
19-09-202619-10-2026
EPSS score4.16%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (code.google.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat6 products
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_hpc_node6.0 | 7.0
- enterprise_linux_hpc_node_eus7.1
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_server_eus6.6z | 7.1
Debian2 products
- freetype< 2.5.2-3
- debian_linuxEOL7.0
Canonical1 product
- ubuntu_linuxEOL10.04 | 12.04 | 14.04 | 14.10 | 15.04
Fedoraproject1 product
- fedoraEOL20 | 21
Freetype1 product
- freetype≤ 2.5.3
Opensuse1 product
- opensuseEOL13.1 | 13.2
Ubuntu1 product
- freetype< 2.5.2-1ubuntu2.4
7 vendors · 13 products
References
19 links
- lists.opensuse.org/opensuse-updates/2015-03/msg00091.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.htmlX Refsource CONFIRMThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2015-February/150162.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
Show all 19 references
- www.mandriva.com/security/advisories?name=MDVSA-2015:055Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
- source.android.com/security/bulletin/2016-11-01.htmlX Refsource CONFIRM
- lists.fedoraproject.org/pipermail/package-announce/2015-February/150148.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
- git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=2c4832d30939b45c05757f0a05128ce64c4cacc7X Refsource CONFIRMIssue Tracking