CVE-2014-9675

Exp

bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font.

Published: 2015-02-08 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2014-9675 is rated High Exploit Risk (69.1/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 4.16%). 1 public exploit reference(s) are indexed (Exploit-DB). EPSS rose +2.75% over the last day, indicating growing attacker interest. Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2014-9675

EDB-ID Source Kind Published Link
— nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2014-9675

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 1.41% 4.16% +2.75%
2 2026-05-13 2.11% 1.41% -0.70%
3 2025-12-28 — 2.11% —

Full EPSS history (14 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2014-9675

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
5.0 2.0 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:P)
Partial confidentiality impact.
Integrity impact (I:N)
No integrity impact.
Availability impact (A:N)
No availability impact.
 10.0 2.9 [email protected]

Weakness enumeration for CVE-2014-9675

OS Trackers for CVE-2014-9675

vendor priority summary link
debian not yet assigned CVE-2014-9675 not yet assigned priority: Debian including 1 source packages (freetype), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2014-9675
gentoo normal CVE-2014-9675: 1 GLSA(s) (201503-05), 1 atom(s) (media-libs/freetype); latest impact normal. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2014-9675
redhat low — https://access.redhat.com/security/cve/CVE-2014-9675
suse medium CVE-2014-9675 severity moderate: SUSE including 328 source package names (amazon/suse-sles-15-sp1-chost-byos-v20210304-hvm-ssd-x86_64, amazon/suse-sles-15-sp1-chost-byos-v20220127-hvm-ssd-x86_64, …), 389 product×package rows across 59 product lines (SUSE Liberty Linux 7, SUSE Linux Enterprise Desktop 11 SP3, … (59 product lines)): Fixed 227, Known Affected 157, Known Not Affected 5. https://www.suse.com/security/cve/CVE-2014-9675/
ubuntu medium CVE-2014-9675 medium priority: Ubuntu including 1 source packages (freetype), 5 status rows across 5 suites (lucid, precise, trusty, upstream, utopic): released 5. https://ubuntu.com/security/CVE-2014-9675

Affected software / configurations for CVE-2014-9675

Vendor Product Version Raw CPE
canonical ubuntu_linux 10.04 cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*
canonical ubuntu_linux 12.04 cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
canonical ubuntu_linux 14.04 cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
canonical ubuntu_linux 14.10 cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
canonical ubuntu_linux 15.04 cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*
freetype freetype <= 2.5.3 cpe:2.3:a:freetype:freetype:*:*:*:*:*:*:*:*
debian debian_linux 7.0 cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
fedoraproject fedora 20 cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*
fedoraproject fedora 21 cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*
redhat enterprise_linux_desktop 6.0 cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_desktop 7.0 cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
redhat enterprise_linux_hpc_node 6.0 cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_hpc_node 7.0 cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*
redhat enterprise_linux_hpc_node_eus 7.1 cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.1:*:*:*:*:*:*:*
redhat enterprise_linux_server 6.0 cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_server 7.0 cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
redhat enterprise_linux_server_eus 6.6.z cpe:2.3:o:redhat:enterprise_linux_server_eus:6.6.z:*:*:*:*:*:*:*
redhat enterprise_linux_server_eus 7.1 cpe:2.3:o:redhat:enterprise_linux_server_eus:7.1:*:*:*:*:*:*:*
redhat enterprise_linux_workstation 6.0 cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_workstation 7.0 cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
opensuse opensuse 13.1 cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
opensuse opensuse 13.2 cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

References for CVE-2014-9675

URL Tags
http://advisories.mageia.org/MGASA-2015-0083.html Third Party Advisory
http://code.google.com/p/google-security-research/issues/detail?id=151 Exploit
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=2c4832d30939b45c05757f0a05128ce64c4cacc7 Issue Tracking
http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150148.html Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150162.html Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-03/msg00091.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0696.html Third Party Advisory
http://www.debian.org/security/2015/dsa-3188 Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2015:055 Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html Third Party Advisory
http://www.securityfocus.com/bid/72986
http://www.ubuntu.com/usn/USN-2510-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2739-1 Third Party Advisory
https://security.gentoo.org/glsa/201503-05
https://source.android.com/security/bulletin/2016-11-01.html
cvelogic Threat Intelligence