OSV-2020-1559 UNKNOWN WRITE in hb_vector_t<CFF::parsed_cs_op_t>::resize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24532 Crash type: UNKNOWN WRITE Crash state: hbvectort::resize hbvectort::push CFF::parsedvaluest::addop...

OSV-2020-1555 Global-buffer-overflow in OT::VarData::get_scalars

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24504 Crash type: Global-buffer-overflow WRITE 4 Crash state: OT::VarData::getscalars OT::VariationStore::getscalars CFF::cff2csinterpenvt::processblend...

OSV-2020-1553 UNKNOWN READ in hb_realloc_impl

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24497 Crash type: UNKNOWN READ Crash state: hbreallocimpl hbvectort::alloc hbvectort::resize...

OSV-2020-1551 UNKNOWN WRITE in CFF::parsed_cs_op_t::set_skip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24507 Crash type: UNKNOWN WRITE Crash state: CFF::parsedcsopt::setskip CFF::parsedcsstrt::addcallop cff1csopsetsubrsubsett::processcallsubr...

OSV-2020-1550 UNKNOWN WRITE in hb_vector_t<CFF::dict_val_t>::resize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24489 Crash type: UNKNOWN WRITE Crash state: hbvectort::resize hbvectort::push CFF::dictvalt hbvectort::push...

OSV-2020-1549 UNKNOWN WRITE in hb_vector_t<CFF::op_str_t>::resize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24500 Crash type: UNKNOWN WRITE Crash state: hbvectort::resize hbvectort::push CFF::parsedvaluest::addop...

harfbuzz:hb-subset-fuzzer: Crash in CFF::parsed_cs_op_t::set_skip

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5668566628827136 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x0000000ffd3...

OSV-2020-1325 Global-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21769 Crash type: Global-buffer-overflow READ 2 Crash state: BEInt::operator unsigned short OT::IntType::operator unsigned int CFF::Charset0::getglyph...

Analyzing Dark Crystal RAT, a C# Backdoor

The FireEye Mandiant Threat Intelligence Team helps protect our customers by tracking cyber attackers and the malware they use. The FLARE Team helps augment our threat intelligence by reverse engineering malware samples. Recently, FLARE worked on a new C variant of Dark Crystal RAT DCRat that the...

stb assertion failure vulnerability

stb is a C/C++ library consisting of a single file. An assertion failure vulnerability exists in stbttcffgetindex in stbtruetype.h in stb 1.22 and earlier. An attacker can exploit this vulnerability to cause a denial of service...

CVE-2020-6623

stb stbtruetype.h through 1.22 has an assertion failure in stbttcffgetindex...

CVE-2020-6617

stb stbtruetype.h through 1.22 has an assertion failure in stbttcffint...

CVE-2020-6617

stb stbtruetype.h through 1.22 has an assertion failure in stbttcffint...

CVE-2020-6623

stb stbtruetype.h through 1.22 has an assertion failure in stbttcffgetindex...

UBUNTU-CVE-2020-6623

stb stbtruetype.h through 1.22 has an assertion failure in stbttcffgetindex...

freetype2:cff-render-ftengine: Invalid-builtin-use in FT_Outline_Get_Orientation

Detailed Report: https://oss-fuzz.com/testcase?key=5735696199581696 Project: freetype2 Fuzzing Engine: libFuzzer Fuzz Target: cff-render-ftengine Job Type: libfuzzerubsanfreetype2 Platform Id: linux Crash Type: Invalid-builtin-use Crash Address: Crash State: FTOutlineGetOrientation...

Adobe Acrobat Reader DC for Windows - Use of Uninitialized Pointer due to Malformed OTF Font (CFF Table)

We have observed the following access violation exception in the latest version of Adobe Acrobat Reader DC for Windows, when opening a malformed PDF file: --- cut --- 5708.4564: Access violation - code c0000005 first chance First chance exceptions are reported before any exception handling. This...

Adobe Acrobat Reader DC for Windows - Use of Uninitialized Pointer due to Malformed OTF Font (CFF Table)

Adobe Acrobat Reader DC for Windows - Use of Uninitialized Pointer due to Malformed OTF Font CFF Table We have observed the following access violation exception in the latest version of Adobe Acrobat Reader DC for Windows, when opening a malformed PDF file: --- cut --- 5708.4564: Access violation...

Microsoft DirectWrite AFDKO - Out-of-Bounds Read in OpenType Font Handling Due to Undefined FontName Index

Microsoft DirectWrite AFDKO - Out-of-Bounds Read in OpenType Font Handling Due to Undefined FontName Index -----===== Background =====----- AFDKO Adobe Font Development Kit for OpenType is a set of tools for examining, modifying and building fonts. The core part of this toolset is a font handling...

Microsoft DirectWrite AFDKO - Stack Corruption in OpenType Font Handling While Processing CFF Blend DICT Operator

Microsoft DirectWrite AFDKO - Stack Corruption in OpenType Font Handling While Processing CFF Blend DICT Operator -----===== Background =====----- AFDKO Adobe Font Development Kit for OpenType is a set of tools for examining, modifying and building fonts. The core part of this toolset is a font...