CVE-2011-0226

EXPLOITED IN THE WILD

FreeType < 2.4.6 - Remote Code Execution via Crafted Type 1 Font

Title source: llm

Exploitation Summary

CVE-2011-0226 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).

Description

Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Type 1 font in a PDF document, as exploited in the wild in July 2011.

References (20)

Core 20

Core References

Mailing List vendor-advisory x_refsource_apple

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/45224

Vendor Advisory x_refsource_confirm

http://support.apple.com/kb/HT4803

Vendor Advisory vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2011//Jul/msg00000.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00015.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/48619

Various Sources mailing-list x_refsource_mlist

http://lists.nongnu.org/archive/html/freetype-devel/2011-07/msg00020.html

Vendor Advisory vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2011//Jul/msg00001.html

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/45167

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2011-1085.html

Vendor Advisory x_refsource_confirm

http://support.apple.com/kb/HT4802

Various Sources mailing-list x_refsource_mlist

http://lists.nongnu.org/archive/html/freetype-devel/2011-07/msg00015.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00016.html

Various Sources mailing-list x_refsource_mlist

http://lists.nongnu.org/archive/html/freetype-devel/2011-07/msg00028.html

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2011/dsa-2294

Vendor Advisory x_refsource_confirm

http://support.apple.com/kb/HT5002

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2011:120

Various Sources x_refsource_misc

http://www.appleinsider.com/articles/11/07/06/hackers_release_new_browser_based_ios_jailbreak_based_on_pdf_exploit.html

Various Sources mailing-list x_refsource_mlist

http://lists.nongnu.org/archive/html/freetype-devel/2011-07/msg00014.html

Various Sources mailing-list x_refsource_mlist

http://lists.nongnu.org/archive/html/freetype-devel/2011-07/msg00026.html

Scores

EPSS 0.0665

EPSS Percentile 93.2%

Details

VulnCheck KEV 2011-07-19

InTheWild.io 2011-10-26

CWE

CWE-189

Status published

Products (50)

apple/iphone_os 1.0.0

apple/iphone_os 1.0.1

apple/iphone_os 1.0.2

apple/iphone_os 1.1.0

apple/iphone_os 1.1.1

apple/iphone_os 1.1.2

apple/iphone_os 1.1.3

apple/iphone_os 1.1.4

apple/iphone_os 1.1.5

apple/iphone_os 2.0

... and 40 more

Published Jul 19, 2011

Tracked Since Feb 18, 2026