Memory corruption in Cairo during PDF font rendering

Memory corruption in Cairo during PDF font rendering

Announced

March 18, 2014

Reporter

John Thomson

Impact

Moderate

Products

Firefox, Firefox ESR, SeaMonkey, Thunderbird

Fixed in

• Firefox 28
• Firefox ESR 24.4
• SeaMonkey 2.25
• Thunderbird 24.4

Description

Security researcher John Thomson discovered a memory corruption in the Cairo graphics library during font rendering of a PDF file for display. This memory corruption leads to a potentially exploitable crash and to a denial of service (DOS). This issues is not able to be triggered in a default configuration and would require a malicious extension to be installed.

References

• memcpy buffer overrun when _cairo_truetype_index_to_ucs4 calls _cairo_dwrite_load_truetype_table (CVE-2014-1509)