CVE-2014-9745: Canonical Ubuntu Linux

Medium severity, CVSS 5.0. EPSS: 3.7% chance of exploitation in the next 30 days.

The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a "broken number-with-base" in a Postscript stream, as demonstrated by 8#garbage.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 15.04 only
• Debian Debian Linux: version 7.0 only; version 8.0 only
• FreeType FreeType: up to and including 2.5.2
• Opensuse Opensuse: version 13.1 only

Published 2015-09-14. Last modified 2026-06-17.