Skip to content
Fencer Intel
critical 9.3

CVE-2010-1797 in the critical feed json

Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF Type2 CharStrings interpreter in cff/cffgloa…

published 2010-08-16 16 y ago modified 2026-06-16 4 mo ago also EUVD-2010-1817

cvss
9.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
33.9%
EPSS 33.9% chance of exploitation in 30 days, percentile 98%
public exploits
2
Exploit-DB

Summary

Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF Type2 CharStrings interpreter in cff/cffgload.c in FreeType before 2.4.2, as used in Apple iOS before 4.0.2 on the iPhone and iPod touch and before 3.2.2 on the iPad, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted CFF opcodes in embedded fonts in a PDF document, as demonstrated by JailbreakMe. NOTE: some of these details are obtained from third party information.

Patch / fix

  • freetype Debian 14, Debian 13, Debian 12 2.4.2-1

debian advisories DEBIAN-CVE-2010-1797

  • freetype RHEL 3 2.1.4-16.el3
  • freetype RHEL 4 2.1.9-15.el4.8
  • freetype RHEL 5 2.2.1-26.el5_5
  • freetype-demos RHEL 4 2.1.9-15.el4.8
  • freetype-demos RHEL 5 2.2.1-26.el5_5
  • freetype-utils RHEL 4 2.1.9-15.el4.8

red hat advisories RHSA-2010:0607

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2010-1797 updated cvss 6.8

FreeType: Multiple stack overflows by processing CFF opcodes

  • Red Hat Desktop version 3 freetype 2.1.4-16.el3 Red Hat Enterprise Linux (v. 5 server) freetype 2.2.1-26.el5_5, freetype-demos 2.2.1-26.el5_5 Red Hat Enterprise Linux AS version 3 freetype 2.1.4-16.el3 Red Hat Enterprise Linux AS version 4 freetype 2.1.9-15.el4.8, freetype-demos 2.1.9-15.el4.8, freetype-utils 2.1.9-15.el4.8 Red Hat Enterprise Linux Desktop (v. 5 client) freetype 2.2.1-26.el5_5 Red Hat Enterprise Linux Desktop version 4 freetype 2.1.9-15.el4.8, freetype-demos 2.1.9-15.el4.8, freetype-utils 2.1.9-15.el4.8
    +5 more products
    Red Hat Enterprise Linux Desktop Workstation (v. 5 client) freetype 2.2.1-26.el5_5, freetype-demos 2.2.1-26.el5_5 Red Hat Enterprise Linux ES version 3 freetype 2.1.4-16.el3 Red Hat Enterprise Linux ES version 4 freetype 2.1.9-15.el4.8, freetype-demos 2.1.9-15.el4.8, freetype-utils 2.1.9-15.el4.8 Red Hat Enterprise Linux WS version 3 freetype 2.1.4-16.el3 Red Hat Enterprise Linux WS version 4 freetype 2.1.9-15.el4.8, freetype-demos 2.1.9-15.el4.8, freetype-utils 2.1.9-15.el4.8
    fixed: vendor fix RHSA-2010:0607
  • Red Hat Enterprise Linux 6 freetype, freetype-demos
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-14538)
  2. Published

Exploit prediction

33.93% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-14727 Foxit Reader 4.0 - '.pdf' Multiple Stack Based Buffer Overflow 'Jailbreak' local, 2010-08-24
  • EDB-14538 Apple iOS - '.pdf' Local Privilege Escalation 'Jailbreak' local, 2010-08-03
  • securityfocus.com http://www.securityfocus.com/bid/42151 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.