Potential memory corruption during font rendering using cairo-dwrite

Related Vulnerabilities: CVE-2012-0472  

Mozilla Foundation Security Advisory 2012-25

Potential memory corruption during font rendering using cairo-dwrite

Announced
April 24, 2012
Reporter
wushi, iDefense
Impact
Critical
Products
Firefox, Firefox ESR, SeaMonkey, Thunderbird, Thunderbird ESR
Fixed in
  • Firefox 12
  • Firefox ESR 10.0.4
  • SeaMonkey 2.9
  • Thunderbird 12
  • Thunderbird ESR 10.0.4

Description

Security research firm iDefense reported that researcher wushi of team509 discovered a memory corruption on Windows Vista and Windows 7 systems with hardware acceleration disabled or using incompatible video drivers. This is created by using cairo-dwrite to attempt to render fonts on an unsupported code path. This corruption causes a potentially exploitable crash on affected systems.

References