CVE-2025-27363

CVE-2025-27363（适用于Chrome 113） 注意：在Chrome中，这并非新漏洞，已于2023年3月通过整合提交修复。此PoC仅针对Chrome无头模式。不过，如果你想探究某些内部原理并了解在slotsize极小时如何利用PartitionAlloc，我认为这会是一篇有趣的读物 xD 作者：Altin tin-z 环境： 提交 a7a083d Ubuntu 20/24 目录： 分析与利用文章 pocrce pocleak tests https://github.com/tin-z/PartitionAllocgdb PoC root@kitploit: python...

CVE-2020-15999

CVE-2020-15999 CVE-2020-15999 Añadida fuente con tabla SBIX basada en Arial - https://docs.microsoft.com/en-us/typography/opentype/spec/sbix Se bloquea en ftview asan.png, pero por alguna razón no consigo que Chrome se bloquee. Los indicadores tampoco se establecen correctamente, por lo que...

Learning-History-of-CFF-bug-in-iphone

Learning-History-of-CFF-bug-in-iphone 深入 CFF 字体，并偶然从某个越狱中了解到 cff 解析中存在的一个 bof（缓冲区溢出）。纯属娱乐。 那么……CFF 到底是什么？据我所知，它是一种文件格式，但让我们试着看看维基百科怎么说：“CFF 充当一个容器，可以将多种字体存储在一个称为 FontSet 的单元中。”（https://docs.fileformat.com/font/cff/）。所以基本上我们可以把字体存储在一起。酷，那接下来呢？嗯，既然它是一种文件格式，那它就必须有某种规范。没错，它确实有，而且并不友好，因为规范有 60...

RHSA-2026:55448 Red Hat Security Advisory: libXfont2 security update

Bulletin has no description...

RHSA-2026:55447 Red Hat Security Advisory: libXfont2 security update

Bulletin has no description...

GLSA-202608-02 : FreeType: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202608-02 FreeType: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in FreeType. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly...

CVE-2026-71391

A flaw was found in GNU Emacs, specifically in GNU Emacs for Android. An off-by-one error can occur when a specially crafted font file is processed due to an improper bounds check. This can cause a heap-based buffer over-read, exposing heap memory contents. Mitigation Do not load untrusted font...

DEBIAN-CVE-2026-71391

GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfntvarysimpleglyph and sfntvarycompoundglyph uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font ...

CVE-2026-71394 Heap Use of Uninitialized Memory in GNU Emacs for Android

GNU Emacs for Android improperly validates the table header input in sfntreadtabledirectory in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a...

CVE-2026-71393 Heap Buffer Overflow in GNU Emacs for Android

GNU Emacs for Android is vulnerable to an integer overflow in sfntreadnametable in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in a...

CVE-2026-71392

GNU Emacs for Android is vulnerable to an integer overflow in the sfntreadcmapformat12 function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit builds, causing a heap buffer overflow write. An attacker can...

CVE-2026-71391 Off-by-One Error in GNU Emacs for Android

GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfntvarysimpleglyph and sfntvarycompoundglyph uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font ...

CVE-2026-71391

GNU Emacs for Android is affected by an off-by-one in the gvar table parser (src/sfnt.c). The shared-coordinate index boundary check in sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() uses a > comparison instead of >=, allowing a crafted TrueType variable font to bypass the check an...

GHSA-FP3F-MC75-235C pypdf: Possible large memory usage for large /ToUnicode streams

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. Patches This has been fixed in pypdf==6.15.0. Workarounds If you cannot...

pypdf: Possible large memory usage for large /ToUnicode streams

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. Patches This has been fixed in pypdf==6.15.0. Workarounds If you cannot...

CVE-2026-18497 The nothings stb TrueType library contains a heap buffer overflow vulnerability

A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbttGetGlyphShapeTT function within the nothings stbtruetype.h library when parsing malformed TTF TrueType Font file...

CVE-2026-18497

A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbttGetGlyphShapeTT function within the nothings stbtruetype.h library when parsing malformed TTF TrueType Font file...

libXfont2: PCF Font Parsing Heap Buffer Overflow

A flaw was found in libXfont2. A specially crafted PCF Portable Compiled Format font file, when processed by libXfont2, can lead to a buffer overflow. This occurs because the font parsing process does not properly validate the size of a bitmap buffer against the glyph metrics provided in the...

Important: Red Hat Security Advisory: libXfont2 security update

An update for libXfont2 is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

libXfont2: PCF Font Parsing Heap Buffer Overflow

A flaw was found in libXfont2. A specially crafted PCF Portable Compiled Format font file, when processed by libXfont2, can lead to a buffer overflow. This occurs because the font parsing process does not properly validate the size of a bitmap buffer against the glyph metrics provided in the...