CVE-2014-9745

What it actually does

The parse_encoding function in type1/t1load.c enters an infinite loop when processing a malformed "number-with-base" construct inside a Postscript stream, causing the process to hang and consume CPU.

Why it matters to the business

Applications that render or process Type-1 fonts become unresponsive, leading to service outages and degraded user experience until the affected process is restarted.

How an attack unfolds

An attacker supplies a crafted Postscript stream containing a broken number-with-base token to any code path that invokes the vulnerable FreeType parser; the parser loops indefinitely, denying service to legitimate users.

How to fix it

Upgrade virglrenderer to 0.6.0-2 on Ubuntu 18.04 LTS or 0.6.0-1 on Debian 11/12/13/14; rebuild and restart any dependent services after the package update.

How to confirm the fix worked

Confirm the installed package version matches or exceeds the listed fixed versions, then attempt to load a test font containing the previously crashing construct and verify the process terminates cleanly without looping.

Typical attack path

1. Identify a network-accessible service that uses the vulnerable font parser to load Type-1 fonts
2. Craft a malicious Postscript font stream embedding an invalid number-with-base sequence
3. Deliver the stream via a supported input channel (file upload, network protocol, or document)
4. Trigger font loading, causing the parser to enter an unrecoverable loop

How to detect it

Monitor process CPU usage and thread activity for sustained high utilization on services that parse Type-1 fonts; review application or system logs for repeated font-loading operations that never complete.

What your security team should do

• Apply the package upgrades immediately on all affected systems
• Inventory services that depend on virglrenderer and schedule restarts during the next maintenance window
• Add the fixed package versions to the organization's approved software baseline