Is this freetype implementation vulnerable to CVE-2020-15999
AngelinaSosa opened this issue · 1 comments
AngelinaSosa commented
Do you know if this vulnerability is applicable ? References:
https://savannah.nongnu.org/bugs/?59308
https://www.mail-archive.com/freetype-announce@nongnu.org/msg00125.html
https://nvd.nist.gov/vuln/detail/CVE-2020-15999
Thank you !
Angelina
HinTak commented
As far as I see it is irrelevant - the upstream bug is about vulnerability in the sbit table reading due to dependency on libpng. It is one of the apple style bitmaps which requires libpng to work. Freetype go does not support reading the sbit bitmaps at all.