GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

SUSE-SU-2025:20204-1

Vulnerability from csaf_suse - Published: 2025-04-24 14:44 - Updated: 2025-04-24 14:44
Summary
Security update for freetype2
Severity
Important
Notes
Title of the patch: Security update for freetype2
Description of the patch: This update for freetype2 fixes the following issues: Update to 2.13.2: * Some fields in the `FT_Outline` structure have been changed from signed to unsigned type, which better reflects the actual usage. It is also an additional means to protect against malformed input. * Rare double-free crashes in the cache subsystem have been fixed. * Excessive stack allocation in the autohinter has been fixed. * The B/W rasterizer has received a major upkeep that results in large performance improvements. The rendering speed has increased and even doubled for very complex glyphs.
Patchnames: SUSE-SLE-Micro-6.0-300
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2014-2240
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.aarch64 —
Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.s390x —
Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2014-2241
Affected products
Recommended 3 products, the same list as for CVE-2014-2240
Threats
Impact important
CVE-2017-8105
5.6 (Medium)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
Recommended 3 products, the same list as for CVE-2014-2240
Threats
Impact moderate
CVE-2017-8287
7 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 3 products, the same list as for CVE-2014-2240
Threats
Impact important
CVE-2022-27404
6.6 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Affected products
Recommended 3 products, the same list as for CVE-2014-2240
Threats
Impact moderate
CVE-2022-27405
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 3 products, the same list as for CVE-2014-2240
Threats
Impact moderate
CVE-2022-27406
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 3 products, the same list as for CVE-2014-2240
Threats
Impact moderate
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/s… self
https://www.suse.com/support/update/announcement/… self
https://lists.suse.com/pipermail/sle-security-upd… self
https://bugzilla.suse.com/1035807 self
https://bugzilla.suse.com/1036457 self
https://bugzilla.suse.com/1079600 self
https://bugzilla.suse.com/1198823 self
https://bugzilla.suse.com/1198830 self
https://bugzilla.suse.com/1198832 self
https://bugzilla.suse.com/867620 self
https://www.suse.com/security/cve/CVE-2014-2240/ self
https://www.suse.com/security/cve/CVE-2014-2241/ self
https://www.suse.com/security/cve/CVE-2017-8105/ self
https://www.suse.com/security/cve/CVE-2017-8287/ self
https://www.suse.com/security/cve/CVE-2022-27404/ self
https://www.suse.com/security/cve/CVE-2022-27405/ self
https://www.suse.com/security/cve/CVE-2022-27406/ self
https://www.suse.com/security/cve/CVE-2014-2240 external
https://bugzilla.suse.com/867620 external
https://bugzilla.suse.com/916867 external
https://www.suse.com/security/cve/CVE-2014-2241 external
https://bugzilla.suse.com/867620 external
https://www.suse.com/security/cve/CVE-2017-8105 external
https://bugzilla.suse.com/1034186 external
https://bugzilla.suse.com/1035807 external
https://bugzilla.suse.com/1036457 external
https://bugzilla.suse.com/1079459 external
https://www.suse.com/security/cve/CVE-2017-8287 external
https://bugzilla.suse.com/1034186 external
https://bugzilla.suse.com/1035807 external
https://bugzilla.suse.com/1036457 external
https://bugzilla.suse.com/1079459 external
https://www.suse.com/security/cve/CVE-2022-27404 external
https://bugzilla.suse.com/1198830 external
https://www.suse.com/security/cve/CVE-2022-27405 external
https://bugzilla.suse.com/1198832 external
https://www.suse.com/security/cve/CVE-2022-27406 external
https://bugzilla.suse.com/1198823 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for freetype2",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for freetype2 fixes the following issues:\n\nUpdate to 2.13.2:\n\n* Some fields in the `FT_Outline` structure have been changed\n  from signed to unsigned type, which better reflects the actual\n  usage. It is also an additional means to protect against\n  malformed input.\n* Rare double-free crashes in the cache subsystem have been fixed.\n* Excessive stack allocation in the autohinter has been fixed.\n* The B/W  rasterizer has received a major upkeep that results in\n  large performance improvements.  The rendering speed has\n  increased and even doubled for very complex glyphs.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.0-300",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_20204-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:20204-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-202520204-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:20204-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-June/021136.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1035807",
        "url": "https://bugzilla.suse.com/1035807"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1036457",
        "url": "https://bugzilla.suse.com/1036457"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1079600",
        "url": "https://bugzilla.suse.com/1079600"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1198823",
        "url": "https://bugzilla.suse.com/1198823"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1198830",
        "url": "https://bugzilla.suse.com/1198830"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1198832",
        "url": "https://bugzilla.suse.com/1198832"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 867620",
        "url": "https://bugzilla.suse.com/867620"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-2240 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-2240/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-2241 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-2241/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-8105 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-8105/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-8287 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-8287/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-27404 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-27404/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-27405 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-27405/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-27406 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-27406/"
      }
    ],
    "title": "Security update for freetype2",
    "tracking": {
      "current_release_date": "2025-04-24T14:44:51Z",
      "generator": {
        "date": "2025-04-24T14:44:51Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:20204-1",
      "initial_release_date": "2025-04-24T14:44:51Z",
      "revision_history": [
        {
          "date": "2025-04-24T14:44:51Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libfreetype6-2.13.3-1.1.aarch64",
                "product": {
                  "name": "libfreetype6-2.13.3-1.1.aarch64",
                  "product_id": "libfreetype6-2.13.3-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libfreetype6-2.13.3-1.1.s390x",
                "product": {
                  "name": "libfreetype6-2.13.3-1.1.s390x",
                  "product_id": "libfreetype6-2.13.3-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libfreetype6-2.13.3-1.1.x86_64",
                "product": {
                  "name": "libfreetype6-2.13.3-1.1.x86_64",
                  "product_id": "libfreetype6-2.13.3-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.0",
                "product": {
                  "name": "SUSE Linux Micro 6.0",
                  "product_id": "SUSE Linux Micro 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreetype6-2.13.3-1.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.aarch64"
        },
        "product_reference": "libfreetype6-2.13.3-1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreetype6-2.13.3-1.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.s390x"
        },
        "product_reference": "libfreetype6-2.13.3-1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfreetype6-2.13.3-1.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.x86_64"
        },
        "product_reference": "libfreetype6-2.13.3-1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-2240",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-2240"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Stack-based buffer overflow in the cf2_hintmap_build function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of stem hints in a font file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.aarch64",
          "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.s390x",
          "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-2240",
          "url": "https://www.suse.com/security/cve/CVE-2014-2240"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 867620 for CVE-2014-2240",
          "url": "https://bugzilla.suse.com/867620"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 916867 for CVE-2014-2240",
          "url": "https://bugzilla.suse.com/916867"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.aarch64",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.s390x",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-24T14:44:51Z",
          "details": "important"
        }
      ],
      "title": "CVE-2014-2240"
    },
    {
      "cve": "CVE-2014-2241",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-2241"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service (assertion failure), as demonstrated by a crafted ttf file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.aarch64",
          "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.s390x",
          "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-2241",
          "url": "https://www.suse.com/security/cve/CVE-2014-2241"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 867620 for CVE-2014-2241",
          "url": "https://bugzilla.suse.com/867620"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.aarch64",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.s390x",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-24T14:44:51Z",
          "details": "important"
        }
      ],
      "title": "CVE-2014-2241"
    },
    {
      "cve": "CVE-2017-8105",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-8105"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.aarch64",
          "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.s390x",
          "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-8105",
          "url": "https://www.suse.com/security/cve/CVE-2017-8105"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1034186 for CVE-2017-8105",
          "url": "https://bugzilla.suse.com/1034186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1035807 for CVE-2017-8105",
          "url": "https://bugzilla.suse.com/1035807"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1036457 for CVE-2017-8105",
          "url": "https://bugzilla.suse.com/1036457"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1079459 for CVE-2017-8105",
          "url": "https://bugzilla.suse.com/1079459"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.aarch64",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.s390x",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.aarch64",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.s390x",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-24T14:44:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-8105"
    },
    {
      "cve": "CVE-2017-8287",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-8287"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.aarch64",
          "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.s390x",
          "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-8287",
          "url": "https://www.suse.com/security/cve/CVE-2017-8287"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1034186 for CVE-2017-8287",
          "url": "https://bugzilla.suse.com/1034186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1035807 for CVE-2017-8287",
          "url": "https://bugzilla.suse.com/1035807"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1036457 for CVE-2017-8287",
          "url": "https://bugzilla.suse.com/1036457"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1079459 for CVE-2017-8287",
          "url": "https://bugzilla.suse.com/1079459"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.aarch64",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.s390x",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.aarch64",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.s390x",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-24T14:44:51Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-8287"
    },
    {
      "cve": "CVE-2022-27404",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-27404"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.aarch64",
          "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.s390x",
          "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-27404",
          "url": "https://www.suse.com/security/cve/CVE-2022-27404"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1198830 for CVE-2022-27404",
          "url": "https://bugzilla.suse.com/1198830"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.aarch64",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.s390x",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.aarch64",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.s390x",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-24T14:44:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-27404"
    },
    {
      "cve": "CVE-2022-27405",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-27405"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.aarch64",
          "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.s390x",
          "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-27405",
          "url": "https://www.suse.com/security/cve/CVE-2022-27405"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1198832 for CVE-2022-27405",
          "url": "https://bugzilla.suse.com/1198832"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.aarch64",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.s390x",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.aarch64",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.s390x",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-24T14:44:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-27405"
    },
    {
      "cve": "CVE-2022-27406",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-27406"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.aarch64",
          "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.s390x",
          "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-27406",
          "url": "https://www.suse.com/security/cve/CVE-2022-27406"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1198823 for CVE-2022-27406",
          "url": "https://bugzilla.suse.com/1198823"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.aarch64",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.s390x",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.aarch64",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.s390x",
            "SUSE Linux Micro 6.0:libfreetype6-2.13.3-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-24T14:44:51Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-27406"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.