Red Hat Build Of Openjdk 11 Els
Monthly
Denial of service in FreeType's CID-keyed font loader allows attackers to exhaust memory and CPU by supplying a crafted font that triggers repeated allocation and decryption of subroutine data across multiple font dictionaries, causing the consuming application or service to hang or terminate. The issue is rated CVSS 5.5 with availability-only impact (A:H, C:N/I:N) and is gated by user interaction - someone or some automated process must actually load and parse the malicious font, which can be delivered by embedding it in a document, web page, or other parsed content. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the Red Hat advisory points to an upstream FreeType fix commit (f3ca71c9900fe860849b3163a6e2c1e765b291d9) and tracks the flaw under Bugzilla 2462295, so a patched release should be expected; the practical risk is highest for unattended font- or document-processing pipelines rather than interactive desktop use.
Denial of service in FreeType's CID-keyed font loader allows attackers to exhaust memory and CPU by supplying a crafted font that triggers repeated allocation and decryption of subroutine data across multiple font dictionaries, causing the consuming application or service to hang or terminate. The issue is rated CVSS 5.5 with availability-only impact (A:H, C:N/I:N) and is gated by user interaction - someone or some automated process must actually load and parse the malicious font, which can be delivered by embedding it in a document, web page, or other parsed content. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the Red Hat advisory points to an upstream FreeType fix commit (f3ca71c9900fe860849b3163a6e2c1e765b291d9) and tracks the flaw under Bugzilla 2462295, so a patched release should be expected; the practical risk is highest for unattended font- or document-processing pipelines rather than interactive desktop use.