CVE-2016-10244: debian debian_linux Out-of-bounds Read
Vulnerability summary
CVE-2016-10244 is a high (CVSS 7.8) Out-of-bounds Read vulnerability in debian debian_linux. EPSS estimates a 3.37% chance of exploitation in the next 30 days, higher than 88.5% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 06-03-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.37%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
+0.13 pp
From 3.23% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (bugs.chromium.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- freetype< 2.6.3-3.1 | < 2.4.9-1.1+deb7u4
- debian_linuxEOL8.0
Alpine1 product
- freetype< 2.5.5-r1 | < 2.6.3-r0 | < 2.6.3-r1
Freetype1 product
- freetype< 2.7.1
Mageia1 product
- freetype2< 2.5.4-2.1.mga5 | < 2.5.4-2.1.mga5.tainted
Ubuntu1 product
- freetype< 2.5.2-1ubuntu2.6 | < 2.6.1-0.1ubuntu2.1
5 vendors · 6 products
References
17 links- git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/ChangeLog?h=VER-2-7X Refsource CONFIRMRelease NotesThird Party AdvisoryREPORT
- bugs.chromium.org/p/oss-fuzz/issues/detail?id=36X Refsource CONFIRMExploitPatchThird Party AdvisoryREPORT
- www.oracle.com/security-alerts/cpuapr2020.htmlX Refsource MISC