The vulnerability of Firefox ESR, the rendering software Graphite 2, and the Thunderbird email client, which allows a hacker to trigger a service failure or obtain confidential information.

🗓️ 17 Mar 2016 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru

TtfUtil:LocaLookup flaw enables data leakage or crashes in Firefox extended release, Graphite rendering engine, and Thunderbird via crafted fonts.

Reporter	Title	Published	Views	Family All 95
IBM Security Bulletins	Security Bulletin: Multiple Mozilla Firefox vulnerability issues in IBM Storwize V7000 Unified.	18 Jun 201800:28	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Mozilla Firefox libgraphite affect PowerKVM (CVE-2016-1521, CVE-2016-1522, CVE-2016-1523, CVE-2016-1526)	18 Jun 201801:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Mozilla Firefox vulnerability issues in IBM SONAS	18 Jun 201800:28	–	ibm
FreeBSD	graphite2 -- code execution vulnerability	5 Feb 201600:00	–	freebsd
Amazon	Important: graphite2	3 May 201600:00	–	amazon
Tenable Nessus	Amazon Linux AMI : graphite2 (ALAS-2016-696)	4 May 201600:00	–	nessus
Tenable Nessus	CentOS 7 : graphite2 (CESA-2016:0594)	7 Apr 201600:00	–	nessus
Tenable Nessus	CentOS 5 / 6 / 7 : firefox (CESA-2016:0695)	27 Apr 201600:00	–	nessus
Tenable Nessus	Debian DSA-3477-1 : iceweasel - security update	15 Feb 201600:00	–	nessus
Tenable Nessus	Debian DSA-3479-1 : graphite2 - security update	22 Feb 201600:00	–	nessus

Vulners

Node

mozilla thunderbirdRange≤38.5.1

OR

sil_international graphite_2Match1.2.4

OR

mozilla firefox_esrRange38.0–38.6.1

Source	Link
mozilla	www.mozilla.org/security/announce/2016/mfsa2016-14.html
blog	www.blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html
web	www.web.nvd.nist.gov/view/vuln/detail

23 Mar 2021 00:00Current

CVSS 25.8

EPSS0.00759

Firefox extended release Graphite rendering engine Thunderbird email client TtfUtil LocaLookup Data leakage Service crashes Crafted font