Published: 13/02/2016 Updated: 05/01/2018

CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.1 | Impact Score: 5.2 | Exploitability Score: 2.8

VMScore: 516

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:P

The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox prior to 43.0 and Firefox ESR 38.x prior to 38.6.1, incorrectly validates a size value, which allows remote malicious users to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.

Vulnerable Product	Search on Vulmon	Subscribe to Product
debian debian linux 8.0
debian debian linux 7.0
mozilla firefox esr 38.2.1
mozilla firefox esr 38.1.1
mozilla firefox esr 38.0
mozilla thunderbird
mozilla firefox esr 38.5.2
mozilla firefox esr 38.5.1
mozilla firefox esr 38.3.0
mozilla firefox esr 38.2.0
mozilla firefox esr 38.1.0
mozilla firefox esr 38.5.0
mozilla firefox esr 38.4.0
mozilla firefox esr 38.0.5
mozilla firefox esr 38.0.1
mozilla firefox esr 38.6.0
sil graphite2 1.2.4
fedoraproject fedora 23
fedoraproject fedora 22

graphite2 could be made to crash or run programs as your login if it opened a specially crafted font ...

Multiple vulnerabilities have been found in the Graphite font rendering engine which might result in denial of service or the execution of arbitrary code if a malformed font file is processed For the oldstable distribution (wheezy), these problems have been fixed in version 135-1~deb7u1 For the stable distribution (jessie), these problems have ...

Holger Fuhrmannek discovered that missing input sanitising in the Graphite font rendering engine could result in the execution of arbitrary code For the oldstable distribution (wheezy), this problem has been fixed in version 3861esr-1~deb7u1 For the stable distribution (jessie), this problem has been fixed in version 3861esr-1~deb8u1 For the ...

Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail client: Multiple memory safety errors, integer overflows, buffer overflows and other implementation errors may lead to the execution of arbitrary code or denial of service For the oldstable distribution (wheezy), these problems have been fixed in ...

Several vulnerabilities were discovered in Graphite2 An attacker able to trick an unsuspecting user into opening specially crafted font files in an application using Graphite2 could exploit these flaws to cause the application to crash or, potentially, execute arbitrary code with the privileges of the application ...

A vulnerability has been discovered in Graphite2 An attacker able to trick an unsuspecting user into opening specially crafted font files in an application using Graphite2 could exploit these flaws to cause the application to crash or, potentially, execute arbitrary code with the privileges of the application ...

CWE-119 CWE-200 http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html http://www.mozilla.org/security/announce/2016/mfsa2016-14.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184623.html http://www.debian.org/security/2016/dsa-3479 http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177520.html http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html http://www.securityfocus.com/bid/82991 http://rhn.redhat.com/errata/RHSA-2016-0594.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00052.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00088.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00058.html http://www.ubuntu.com/usn/USN-2902-1 https://security.gentoo.org/glsa/201701-63 https://security.gentoo.org/glsa/201701-35 http://rhn.redhat.com/errata/RHSA-2016-0695.html https://usn.ubuntu.com/2902-1/https://nvd.nist.gov

CVE-2016-1526

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect