CVE-2014-9656

What it actually does

Integer overflow in tt_sbit_decoder_load_image during OpenType font parsing allows out-of-bounds read and potential memory corruption.

Why it matters to the business

Applications processing untrusted fonts may crash or be compromised, leading to service disruption and possible remote code execution in browser or document viewers.

How an attack unfolds

An attacker creates a malicious OpenType font file that triggers the integer overflow during bitmap image loading; the file is delivered to the victim via web page, document attachment, or download, and the vulnerable font engine processes it without bounds validation.

How to fix it

Upgrade chromium-browser on Ubuntu 14.04 LTS to version 50.0.2661.102-0ubuntu0.14.04.1.1117 or later; apply equivalent FreeType updates in other products that embed the library.

How to confirm the fix worked

Verify the installed package version matches or exceeds the fixed release; test with known trigger fonts in a controlled environment to confirm absence of out-of-bounds behavior.

Typical attack path

1. Craft malicious OpenType font exploiting integer overflow in sbit decoder
2. Host or embed the font in a web page, email attachment, or document
3. Victim application loads and parses the font using the vulnerable FreeType library
4. Out-of-bounds read occurs leading to crash or memory corruption

How to detect it

Review application crash logs and font parsing error events around the time of suspected incidents; monitor for repeated loading of unusual font files from external sources.

What your security team should do

• Prioritize patching chromium-browser and any other FreeType-dependent packages within the next 30 days
• Inventory all systems that render untrusted fonts and schedule upgrades
• Implement application sandboxing and font isolation where feasible until patches are deployed