CVE-2011-1908

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

Integer overflow in the Type 1 font decoder in the FreeType engine in Foxit Reader before 4.0.0.0619 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted font in a PDF document.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-189

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.foxitsoftware.com/products/reader/security_bulletins.php#freetypePatch, Vendor Advisory
http://www.microsoft.com/technet/security/advisory/msvr11-005.mspxThird Party Advisory
http://www.securityfocus.com/bid/48359Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/68145
http://www.foxitsoftware.com/products/reader/security_bulletins.php#freetypePatch, Vendor Advisory
http://www.microsoft.com/technet/security/advisory/msvr11-005.mspxThird Party Advisory
http://www.securityfocus.com/bid/48359Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/68145

Timeline

Published: Jun 24, 2011
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-19105.0Off-by-one error in named in ISC BIND 9.x before 9.7.3-P1, 9.8.x before 9.8.0-P2, 9.4-ESV before 9.4-ESV-R4-P1, and 9.6-ESV before 9.6-ESV-R CVE-2011-19116.8JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable _flowExecutionKey parameter, which makes it easier CVE-2011-19137.5SQL injection vulnerability in the login form in the web interface in Mercator SENTINEL 2.0 allows remote attackers to execute arbitrary SQL CVE-2011-191410.0Buffer overflow in the Advantech ADAM OLE for Process Control (OPC) Server ActiveX control in ADAM OPC Server before 3.01.012, Modbus RTU OP CVE-2011-19157.5SQL injection vulnerability in eClient 7.3.2.3 in Enspire Distribution Management Solution 7.3.2.7 allows remote attackers to execute arbitr CVE-2011-191810.0Stack-based buffer overflow in the Data Archiver service in GE Intelligent Platforms Proficy Historian before 3.5 SIM 17 and 4.x before 4.0 CVE-2011-191910.0Multiple stack-based buffer overflows in GE Intelligent Platforms Proficy Applications before 4.4.1 SIM 101 and 5.x before 5.0 SIM 43 allow CVE-2011-19203.3The make include files in NetBSD before 1.6.2, as used in pmake 1.111 and other products, allow local users to overwrite arbitrary files via CVE-2011-19214.3The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz CVE-2011-19224.3daemon/worker.c in Unbound 1.x before 1.4.10, when debugging functionality and the interface-automatic option are enabled, allows remote att CVE-2011-19234.0The Diffie-Hellman key-exchange implementation in dhm.c in PolarSSL before 0.14.2 does not properly validate a public parameter, which makes CVE-2011-19245.0Buffer overflow in the policy_summarize function in or/policies.c in Tor before 0.2.1.30 allows remote attackers to cause a denial of servic