PT-2016-1279 · Mozilla+5 · Libgraphite+9
CVSS v3.1
8.1
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Graphite 2 versions 1.2.4 and earlier
Mozilla Firefox versions prior to 43.0
Mozilla Firefox ESR versions 38.x prior to 38.6.1
Thunderbird (affected versions not specified)
Description
The issue is related to the
TtfUtil:LocaLookup function in Libgraphite, which lacks protection of internal data. This can be exploited by a remote attacker using a specially crafted Graphite smart font, potentially allowing them to obtain confidential information or cause a denial of service, including out-of-bounds read and application crash.Recommendations
For Graphite 2 version 1.2.4 and earlier, update to a version later than 1.2.4.
For Mozilla Firefox versions prior to 43.0, update to version 43.0 or later.
For Mozilla Firefox ESR versions 38.x prior to 38.6.1, update to version 38.6.1 or later.
For Thunderbird, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
Information Disclosure
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Graphite 2
Libgraphite
Firefox
Firefox Esr
Red Hat
Suse
Thunderbird
Ubuntu