OESA-2025-1300

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1300

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2025-1300.json

JSON Data

https://api.test.osv.dev/v1/vulns/OESA-2025-1300

Upstream

CVE-2025-27363

Published

2025-03-21T13:17:39Z

Modified

2025-08-12T05:49:40.989512Z

Summary

freetype security update

Details

FreeType is written in C, designed to be small,efficient, highly customizable, and portable while capable of producing high-quality output (glyph images) of most vector and bitmap font formats

Security Fix(es):

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.(CVE-2025-27363)

Database specific

{
    "severity": "High"
}

References

Affected packages

openEuler:22.03-LTS-SP3 / freetype

Package

Name: freetype
Purl: pkg:rpm/openEuler/freetype&distro=openEuler-22.03-LTS-SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.12.1-4.oe2203sp3

Ecosystem specific

{
    "src": [
        "freetype-2.12.1-4.oe2203sp3.src.rpm"
    ],
    "x86_64": [
        "freetype-2.12.1-4.oe2203sp3.x86_64.rpm",
        "freetype-debuginfo-2.12.1-4.oe2203sp3.x86_64.rpm",
        "freetype-debugsource-2.12.1-4.oe2203sp3.x86_64.rpm",
        "freetype-demos-2.12.1-4.oe2203sp3.x86_64.rpm",
        "freetype-devel-2.12.1-4.oe2203sp3.x86_64.rpm"
    ],
    "aarch64": [
        "freetype-2.12.1-4.oe2203sp3.aarch64.rpm",
        "freetype-debuginfo-2.12.1-4.oe2203sp3.aarch64.rpm",
        "freetype-debugsource-2.12.1-4.oe2203sp3.aarch64.rpm",
        "freetype-demos-2.12.1-4.oe2203sp3.aarch64.rpm",
        "freetype-devel-2.12.1-4.oe2203sp3.aarch64.rpm"
    ],
    "noarch": [
        "freetype-help-2.12.1-4.oe2203sp3.noarch.rpm"
    ]
}

openEuler:22.03-LTS-SP4 / freetype

Package

Name: freetype
Purl: pkg:rpm/openEuler/freetype&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.12.1-4.oe2203sp4

Ecosystem specific

{
    "src": [
        "freetype-2.12.1-4.oe2203sp4.src.rpm"
    ],
    "x86_64": [
        "freetype-2.12.1-4.oe2203sp4.x86_64.rpm",
        "freetype-debuginfo-2.12.1-4.oe2203sp4.x86_64.rpm",
        "freetype-debugsource-2.12.1-4.oe2203sp4.x86_64.rpm",
        "freetype-demos-2.12.1-4.oe2203sp4.x86_64.rpm",
        "freetype-devel-2.12.1-4.oe2203sp4.x86_64.rpm"
    ],
    "aarch64": [
        "freetype-2.12.1-4.oe2203sp4.aarch64.rpm",
        "freetype-debuginfo-2.12.1-4.oe2203sp4.aarch64.rpm",
        "freetype-debugsource-2.12.1-4.oe2203sp4.aarch64.rpm",
        "freetype-demos-2.12.1-4.oe2203sp4.aarch64.rpm",
        "freetype-devel-2.12.1-4.oe2203sp4.aarch64.rpm"
    ],
    "noarch": [
        "freetype-help-2.12.1-4.oe2203sp4.noarch.rpm"
    ]
}

openEuler:24.03-LTS / freetype

Package

Name: freetype
Purl: pkg:rpm/openEuler/freetype&distro=openEuler-24.03-LTS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.13.2-3.oe2403sp1

Ecosystem specific

{
    "src": [
        "freetype-2.13.2-3.oe2403.src.rpm",
        "freetype-2.13.2-3.oe2403sp1.src.rpm"
    ],
    "x86_64": [
        "freetype-2.13.2-3.oe2403.x86_64.rpm",
        "freetype-debuginfo-2.13.2-3.oe2403.x86_64.rpm",
        "freetype-debugsource-2.13.2-3.oe2403.x86_64.rpm",
        "freetype-demos-2.13.2-3.oe2403.x86_64.rpm",
        "freetype-devel-2.13.2-3.oe2403.x86_64.rpm",
        "freetype-2.13.2-3.oe2403sp1.x86_64.rpm",
        "freetype-debuginfo-2.13.2-3.oe2403sp1.x86_64.rpm",
        "freetype-debugsource-2.13.2-3.oe2403sp1.x86_64.rpm",
        "freetype-demos-2.13.2-3.oe2403sp1.x86_64.rpm",
        "freetype-devel-2.13.2-3.oe2403sp1.x86_64.rpm"
    ],
    "aarch64": [
        "freetype-2.13.2-3.oe2403.aarch64.rpm",
        "freetype-debuginfo-2.13.2-3.oe2403.aarch64.rpm",
        "freetype-debugsource-2.13.2-3.oe2403.aarch64.rpm",
        "freetype-demos-2.13.2-3.oe2403.aarch64.rpm",
        "freetype-devel-2.13.2-3.oe2403.aarch64.rpm",
        "freetype-2.13.2-3.oe2403sp1.aarch64.rpm",
        "freetype-debuginfo-2.13.2-3.oe2403sp1.aarch64.rpm",
        "freetype-debugsource-2.13.2-3.oe2403sp1.aarch64.rpm",
        "freetype-demos-2.13.2-3.oe2403sp1.aarch64.rpm",
        "freetype-devel-2.13.2-3.oe2403sp1.aarch64.rpm"
    ],
    "noarch": [
        "freetype-help-2.13.2-3.oe2403.noarch.rpm",
        "freetype-help-2.13.2-3.oe2403sp1.noarch.rpm"
    ]
}

openEuler:24.03-LTS-SP1 / freetype

Package

Name: freetype
Purl: pkg:rpm/openEuler/freetype&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.13.2-3.oe2403sp1

Ecosystem specific

{
    "src": [
        "freetype-2.13.2-3.oe2403sp1.src.rpm"
    ],
    "x86_64": [
        "freetype-2.13.2-3.oe2403sp1.x86_64.rpm",
        "freetype-debuginfo-2.13.2-3.oe2403sp1.x86_64.rpm",
        "freetype-debugsource-2.13.2-3.oe2403sp1.x86_64.rpm",
        "freetype-demos-2.13.2-3.oe2403sp1.x86_64.rpm",
        "freetype-devel-2.13.2-3.oe2403sp1.x86_64.rpm"
    ],
    "aarch64": [
        "freetype-2.13.2-3.oe2403sp1.aarch64.rpm",
        "freetype-debuginfo-2.13.2-3.oe2403sp1.aarch64.rpm",
        "freetype-debugsource-2.13.2-3.oe2403sp1.aarch64.rpm",
        "freetype-demos-2.13.2-3.oe2403sp1.aarch64.rpm",
        "freetype-devel-2.13.2-3.oe2403sp1.aarch64.rpm"
    ],
    "noarch": [
        "freetype-help-2.13.2-3.oe2403sp1.noarch.rpm"
    ]
}

openEuler:20.03-LTS-SP4 / freetype

Package

Name: freetype
Purl: pkg:rpm/openEuler/freetype&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.10.2-6.oe2003sp4

Ecosystem specific

{
    "src": [
        "freetype-2.10.2-6.oe2003sp4.src.rpm"
    ],
    "x86_64": [
        "freetype-2.10.2-6.oe2003sp4.x86_64.rpm",
        "freetype-debuginfo-2.10.2-6.oe2003sp4.x86_64.rpm",
        "freetype-debugsource-2.10.2-6.oe2003sp4.x86_64.rpm",
        "freetype-devel-2.10.2-6.oe2003sp4.x86_64.rpm"
    ],
    "aarch64": [
        "freetype-2.10.2-6.oe2003sp4.aarch64.rpm",
        "freetype-debuginfo-2.10.2-6.oe2003sp4.aarch64.rpm",
        "freetype-debugsource-2.10.2-6.oe2003sp4.aarch64.rpm",
        "freetype-devel-2.10.2-6.oe2003sp4.aarch64.rpm"
    ],
    "noarch": [
        "freetype-help-2.10.2-6.oe2003sp4.noarch.rpm"
    ]
}