Log in Start free

Vulnerability · Published Apr 22, 2022 · Assigned by mitre

CVE-2022-27406

High 7.5

In plain English

A high-severity security flaw in the freetype package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High
Exploit odds (30 days)3.3%top 11.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8freetype2.9.1-9.el8ALSA-2022:7745
AlmaLinux:9freetype2.10.4-9.el9ALSA-2022:8340
AlmaLinux:8freetype-devel2.9.1-9.el8ALSA-2022:7745
AlmaLinux:9freetype-devel2.10.4-9.el9ALSA-2022:8340
Alpine:v3.20freetype2.12.1-r0ALPINE-CVE-2022-27406
Alpine:v3.21freetype2.12.1-r0ALPINE-CVE-2022-27406
Alpine:v3.22freetype2.12.1-r0ALPINE-CVE-2022-27406
Alpine:v3.23freetype2.12.1-r0ALPINE-CVE-2022-27406
Alpine:v3.24freetype2.12.1-r0ALPINE-CVE-2022-27406
Alpine:v3.20qt5-qtwebengine5.15.3_git20220601-r2ALPINE-CVE-2022-27406
Alpine:v3.21qt5-qtwebengine5.15.3_git20220601-r2ALPINE-CVE-2022-27406
Alpine:v3.22qt5-qtwebengine5.15.3_git20220601-r2ALPINE-CVE-2022-27406
Alpine:v3.23qt5-qtwebengine5.15.3_git20220601-r2ALPINE-CVE-2022-27406
Debian:12freetype2.11.1+dfsg-2DEBIAN-CVE-2022-27406
Debian:13freetype2.11.1+dfsg-2DEBIAN-CVE-2022-27406
Debian:14freetype2.11.1+dfsg-2DEBIAN-CVE-2022-27406
Rocky Linux:8freetype0:2.9.1-9.el8RLSA-2022:7745
Rocky Linux:9freetype0:2.10.4-9.el9RLSA-2022:8340
Ubuntu:22.04:LTSfreetype2.11.1+dfsg-1ubuntu0.1UBUNTU-CVE-2022-27406
Ubuntu:22.04:LTSfreetype2.11.1+dfsg-1ubuntu0.1USN-5528-1

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References