Opened 2 years ago

Closed 2 years ago

#14153 closed enhancement (fixed)


Reported by: ken@… Owned by: ken@…
Priority: high Milestone: 10.1
Component: BOOK Version: SVN
Severity: normal Keywords:


New release: per

FreeType 2.10.4


This is an emergency release, fixing a severe vulnerability in embedded PNG bitmap handling (see here for more).

All users should update immediately.

According to phoronix this is for CVE-2020-15999 which is apparently a heap buffer overflow and has been present since freetype-2.6 (which was 5 years ago).

Change History (5)

comment:1 by ken@…, 2 years ago

Owner: changed from blfs-book to ken@…
Status: newassigned

comment:2 by Douglas R. Reno, 2 years ago

Before making this release, Werner said:

> I've just fixed a heap buffer overflow that can happen for some
> malformed `.ttf` files with PNG sbit glyphs.  It seems that this
> vulnerability gets already actively used in the wild, so I ask all
> users to apply the corresponding commit as soon as possible.

But distros should be warned that 2.10.3 and later may break the build
of ghostscript, due to ghostscript's use of a withdrawn macro that
wasn't intended for external usage:

Ghostscript's fix for that is at:;a=commitdiff;h=41ef9a0bc36b

    -Alan Coopersmith-     
     Oracle Solaris Engineering -

-------- Forwarded Message --------
Subject: [ft-announce] Announcing FreeType 2.10.4
Date: Tue, 20 Oct 2020 07:47:31 +0200 (CEST)
From: Werner LEMBERG <>

FreeType 2.10.4 has been released.

It is available from


The latter site also holds older versions of the FreeType library.

See below for the relevant snippet from the CHANGES file.



PS: Downloads from  will redirect to your nearest
    mirror site.   Files on  mirrors may  be subject to  a replication
    delay   of   up   to   24   hours.   In   case   of  problems  use


FreeType 2  is a software  font engine that  is designed to  be small,
efficient,  highly   customizable,  and  portable   while  capable  of
producing high-quality output (glyph images) of most vector and bitmap
font formats.

Note that  FreeType 2 is  a font service  and doesn't provide  APIs to
perform higher-level features, like text layout or graphics processing
(e.g.,  colored  text  rendering,  `hollowing',  etc.).   However,  it
greatly simplifies these tasks by providing a simple, easy to use, and
uniform interface to access the content of font files.

FreeType  2  is  released  under  two open-source  licenses:  our  own
BSD-like FreeType  License and the  GPL.  It can  thus be used  by any
kind of projects, be they proprietary or not.


CHANGES BETWEEN 2.10.3 and 2.10.4


  - A heap buffer overflow has been found  in the handling of embedded
    PNG bitmaps, introduced in FreeType version 2.6.

    If you  use option  FT_CONFIG_OPTION_USE_PNG  you  should  upgrade

Freetype-announce mailing list

We're going to need a fix for Ghostscript too. Please put that in with this update.

comment:3 by ken@…, 2 years ago

Ah, thanks for that - I was not aware.

comment:5 by ken@…, 2 years ago

Resolution: fixed
Status: assignedclosed
Note: See TracTickets for help on using tickets.