Learning-History-of-CFF-bug-in-iphone

아이폰 CFF 버그 학습 기록 CFF 폰트를 파고들다가 우연히 어떤 jailbreak에서 cff 파싱의 버퍼 오버플로우에 대해 알게 되었다. 그냥 재미로. 그래서... CFF가 뭔데? 내가 아는 한 파일 형식이지만, 위키피디아가 뭐라고 하는지 한번 보자: "CFF는 FontSet이라는 단일 단위로 여러 글꼴을 함께 저장하는 컨테이너 역할을 한다." https://docs.fileformat.com/font/cff/ 즉 기본적으로 글꼴을 함께 저장할 수 있다. 좋아, 그럼 이제 뭐? 음, 파일 형식이니 스펙이 있어야 하고, 실제...

CVE-2026-63275

A flaw was found in LibreOffice. When a user opens a specially crafted document containing embedded CFF fonts, a stack-based buffer overflow can occur when reading the hints of a glyph due to improper bounds checking. This issue can cause memory corruption, resulting in an application crash...

DEBIAN-CVE-2026-63275

LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint...

CVE-2026-63275

LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint...

CVE-2026-63276

CVE-2026-63276 is a stack buffer overflow in LibreOffice 's CFF-to-Type 1 font conversion, which occurs when the application subsets fonts during PDF export. A glyph that emits many operators writes past the end of a fixed-size buffer with no bounds check. In fixed versions, remaining capacity is...

EUVD-2026-84355

LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint...

CVE-2026-63275 Stack buffer overflow in CFF font hint handling

LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past its end. In fixed versions the hint...

CVE-2026-63275

LibreOffice is vulnerable to a stack buffer overflow when processing CFF fonts embedded in documents. The root cause is a bounds-checking error: the number of glyph hints was validated against the wrong limit, allowing a crafted glyph to declare more hints than the stack array could hold and writ...

PT-2023-35761 · Git +1 · Ghostscript

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN READ. The crash state involves functions such as pdfi read cff font, pdfi load font buffer, and pdfi load...

SUSE CVE-2010-3311

Integer overflow in base/ftstream.c in libXft aka the X FreeType library in FreeType before 2.4 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted Compact Font Format CFF font file that triggers a heap-based buffer overflow,...

(Pwn2Own) HP LaserJet Pro MFP M283fdw CFF Font Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of HP LaserJet Pro MFP M283fdw printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PostScript interpreter. Crafted data in a CFF font can...

Out-of-Bounds Write

freetype is vulnerable to an out-of-bounds write. A malicious user can pass a cff font file to the application to cause a heap-based buffer overflow that can lead to an out-of-bounds write. This can cause the application to crash or overwrite values in the heap...

MS11-007: Vulnerability in the OpenType Compact Font Format (CFF) Driver Could Allow Remote Code Execution (2485376)

The remote Windows host contains a version of the OpenType Compact Font Format CFF Font Driver that fails to properly validate certain data passed from user mode to kernel mode. A remote attacker could exploit this by tricking a user into viewing content rendered in a specially crafted CFF font v...

CVE-2010-3311

Integer overflow in base/ftstream.c in libXft aka the X FreeType library in FreeType before 2.4 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted Compact Font Format CFF font file that triggers a heap-based buffer overflow,...

Integer overflow

Integer overflow in base/ftstream.c in libXft aka the X FreeType library in FreeType before 2.4 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted Compact Font Format CFF font file that triggers a heap-based buffer overflow,...

CVE-2010-3311

Integer overflow in base/ftstream.c in libXft aka the X FreeType library in FreeType before 2.4 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted Compact Font Format CFF font file that triggers a heap-based buffer overflow,...

CVE-2010-3311

CVE-2010-3311 is a FreeType/ libXft vulnerability caused by an input-stream position error that can trigger a heap-based buffer overflow in CFF processing, leading to remote code execution or a crash when processing crafted fonts. Public advisories (Debian DSA-2105-1/DSA-2105-1:33FFA, CentOS CESA...

CVE-2010-3311

Integer overflow in base/ftstream.c in libXft aka the X FreeType library in FreeType before 2.4 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted Compact Font Format CFF font file that triggers a heap-based buffer overflow,...

Integer overflow

Integer signedness error in Apple Type Services ATS in Apple Mac OS X 10.5.8 allows remote attackers to execute arbitrary code via a crafted embedded Compact Font Format CFF font in a document...

Heap overflow

Heap-based buffer overflow in Apple Type Services ATS in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 allows remote attackers to execute arbitrary code via a crafted Compact Font Format CFF font...