# CVEs published 2015-02-08

20 CVEs were published on February 8, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2014-9656](https://cve.now/CVE-2014-9656.md): The tt\_sbit\_decoder\_load\_image function in sfnt/ttsbit.c in FreeType before 2.5.4 does not properly check for an integer overflow, which all (no CVSS)
- [CVE-2014-9657](https://cve.now/CVE-2014-9657.md): The tt\_face\_load\_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote (no CVSS)
- [CVE-2014-9658](https://cve.now/CVE-2014-9658.md): The tt\_face\_load\_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote att (no CVSS)
- [CVE-2014-9659](https://cve.now/CVE-2014-9659.md): cff/cf2intrp.c in the CFF CharString interpreter in FreeType before 2.5.4 proceeds with additional hints after the hint mask has been comput (no CVSS)
- [CVE-2014-9660](https://cve.now/CVE-2014-9660.md): The \_bdf\_parse\_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remo (no CVSS)
- [CVE-2014-9661](https://cve.now/CVE-2014-9661.md): type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remot (no CVSS)
- [CVE-2014-9662](https://cve.now/CVE-2014-9662.md): cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows remote attackers to cau (no CVSS)
- [CVE-2014-9663](https://cve.now/CVE-2014-9663.md): The tt\_cmap4\_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is compl (no CVSS)
- [CVE-2014-9664](https://cve.now/CVE-2014-9664.md): FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial (no CVSS)
- [CVE-2014-9665](https://cve.now/CVE-2014-9665.md): The Load\_SBit\_Png function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows (no CVSS)
- [CVE-2014-9666](https://cve.now/CVE-2014-9666.md): The tt\_sbit\_decoder\_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting th (no CVSS)
- [CVE-2014-9667](https://cve.now/CVE-2014-9667.md): sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attacker (no CVSS)
- [CVE-2014-9668](https://cve.now/CVE-2014-9668.md): The woff\_open\_font function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting length va (no CVSS)
- [CVE-2014-9669](https://cve.now/CVE-2014-9669.md): Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read (no CVSS)
- [CVE-2014-9670](https://cve.now/CVE-2014-9670.md): Multiple integer signedness errors in the pcf\_get\_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cau (no CVSS)
- [CVE-2014-9671](https://cve.now/CVE-2014-9671.md): Off-by-one error in the pcf\_get\_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of s (no CVSS)
- [CVE-2014-9672](https://cve.now/CVE-2014-9672.md): Array index error in the parse\_fond function in base/ftmac.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service ( (no CVSS)
- [CVE-2014-9673](https://cve.now/CVE-2014-9673.md): Integer signedness error in the Mac\_Read\_POST\_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a (no CVSS)
- [CVE-2014-9674](https://cve.now/CVE-2014-9674.md): The Mac\_Read\_POST\_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the o (no CVSS)
- [CVE-2014-9675](https://cve.now/CVE-2014-9675.md): bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-02-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.