search

snykiotcubedev / godot-3.3-stable

MIT License
0 stars 0 forks source link

CVE-2023-20958 (High) detected in freetypefreetype-2.10.4 #43

Open mend-bolt-for-github[bot] opened 1 year ago

mend-bolt-for-github[bot] commented 1 year ago

CVE-2023-20958 - High Severity Vulnerability

Vulnerable Library - freetypefreetype-2.10.4

A free, high-quality, and portable font engine

Library home page: https://sourceforge.net/projects/freetype/

Found in base branch: main

Vulnerable Source Files (1)

/thirdparty/freetype/src/sfnt/ttcolr.c

Vulnerability Details

In read_paint of ttcolr.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-254803162

Publish Date: 2023-03-24

URL: CVE-2023-20958

CVSS 3 Score Details (7.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://android.googlesource.com/platform/external/freetype/+/e0c9c8b35e2071d0591c151cd7d752bdf783f747

Release Date: 2023-03-24

Fix Resolution: android-13.0.0_r32

Step up your Open Source Security Game with Mend here