CVE-2010-1797

CVSS V2 High 9.3 CVSS V3 None
Description
Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF Type2 CharStrings interpreter in cff/cffgload.c in FreeType before 2.4.2, as used in Apple iOS before 4.0.2 on the iPhone and iPod touch and before 3.2.2 on the iPad, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted CFF opcodes in embedded fonts in a PDF document, as demonstrated by JailbreakMe. NOTE: some of these details are obtained from third party information.
Overview
  • CVE ID
  • CVE-2010-1797
  • Assigner
  • product-security@apple.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2010-08-16T18:39:40
  • Last Modified Date
  • 2021-05-23T00:52:44
Weakness Enumerations
CWE URL
CWE-119 http://cwe.mitre.org/data/definitions/119.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:o:apple:iphone_os:1.0.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:1.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:1.0.1:-:iphone:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:1.0.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:1.0.2:-:iphone:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:1.1.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:1.1.0:-:iphone:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:1.1.0:-:ipodtouch:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:1.1.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:1.1.1:-:iphone:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:1.1.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:1.1.2:-:iphone:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:1.1.2:-:ipodtouch:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:1.1.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:1.1.3:-:iphone:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:1.1.3:-:ipodtouch:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:1.1.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:1.1.4:-:iphone:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:1.1.4:-:ipodtouch:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:1.1.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:1.1.5:-:iphone:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:1.1.5:-:ipodtouch:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:2.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:2.0.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:2.0.0:-:iphone:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:2.0.0:-:ipodtouch:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:2.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:2.0.1:-:iphone:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:2.0.1:-:ipodtouch:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:2.0.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:2.0.2:-:iphone:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:2.0.2:-:ipodtouch:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:2.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:2.1:-:iphone:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:2.1:-:ipodtouch:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:2.1.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:2.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:2.2:-:iphone:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:2.2.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:2.2.1:-:iphone:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:2.2.1:-:ipodtouch:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:3.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:3.0:-:iphone:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:3.0:-:ipodtouch:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:3.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:3.0.1:-:ipodtouch:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:3.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:3.1:-:iphone:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:3.1:-:ipodtouch:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:3.1.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:3.1.2:-:iphone:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:3.1.2:-:ipodtouch:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:3.1.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:3.1.3:-:iphone:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:3.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:3.2:-:iphone:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:3.2:-:ipodtouch:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:3.2.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:3.2.1:-:ipad:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:4.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:4.0:-:iphone:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:4.0:-:ipodtouch:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:4.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:4.0.1:-:iphone:*:*:*:*:* 1 OR
cpe:2.3:o:apple:iphone_os:4.0.1:-:ipodtouch:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:C/I:C/A:C
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • COMPLETE
  • Integrity Impact
  • COMPLETE
  • Availability Impact
  • COMPLETE
  • Base Score
  • 9.3
  • Severity
  • HIGH
  • Exploitability Score
  • 8.6
  • Impact Score
  • 10
References
Reference URL Reference Tags
http://support.apple.com/kb/HT4292 Vendor Advisory
http://osvdb.org/66828
http://lists.apple.com/archives/security-announce/2010//Aug/msg00001.html Vendor Advisory
http://www.exploit-db.com/exploits/14538 Exploit
http://secunia.com/advisories/40807 Vendor Advisory
http://lists.apple.com/archives/security-announce/2010//Aug/msg00000.html
http://support.apple.com/kb/HT4291 Vendor Advisory
http://www.securityfocus.com/bid/42151 Exploit
http://www.ubuntu.com/usn/USN-972-1
https://bugs.launchpad.net/ubuntu/maverick/+source/freetype/+bug/617019
http://www.vupen.com/english/advisories/2010/2106 Vendor Advisory
http://www.vupen.com/english/advisories/2010/2018 Vendor Advisory
http://www.f-secure.com/weblog/archives/00002002.html
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=018f5c27813dd7eef4648fe254632ecea0c85a50
http://freetype.sourceforge.net/index2.html#release-freetype-2.4.2
https://bugzilla.redhat.com/show_bug.cgi?id=621144
http://secunia.com/advisories/40816 Vendor Advisory
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=11d65e8a1f1f14e56148fd991965424d9bd1cdbc
http://sourceforge.net/projects/freetype/files/freetype2/2.4.2/NEWS/view
http://secunia.com/advisories/40982 Vendor Advisory
http://secunia.com/advisories/48951
https://exchange.xforce.ibmcloud.com/vulnerabilities/60856
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2010-1797
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1797
History
Created Old Value New Value Data Type Notes
2022-05-10 16:15:10 Added to TrackCVE