CVE-2016-7627

An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the "CoreGraphics" component. It allows attackers to cause a denial of service NULL pointer dereference and application crash via ...

CVE-2016-4667

CVE-2016-4667 affects macOS prior to 10.12.1 (macOS Sierra) in the ATS component. A memory corruption vulnerability caused by processing a crafted font could allow remote code execution or a denial of service. Apple released macOS 10.12.1 (Security Update 2016-002) to address this issue. No explo...

The vulnerability of the Microsoft Office suite of programs, the Word Viewer program for reading doc files, the Windows operating system, Microsoft Lync and Skype for Business instant messaging programs, and the Live Meeting software used for web conferences allow a perpetrator to execute arbitrary code.

The vulnerability of the Windows font library in the Microsoft Office software suite, including Word Viewer for reading DOC files, as well as operating systems like Windows, and messaging applications like Microsoft Lync and Skype for Business, and the software for conducting web conferences like...

Adobe Acrobat Reader DC 15.016.20045 - Invalid Font '.ttf' Memory Corruption (3)

Application: Adobe Acrobat Reader DC Platforms: Windows,OSX Versions: 15.016.20045 and earlier Author: Sébastien Morin of COSIG Website: https://cosig.gouv.qc.ca/en/advisory/ Twitter: @COSIG Date: July 12, 2016 CVE: CVE-2016-4203 COSIG-2016-28 1 Introduction 2 Report Timeline 3 Technical details ...

The vulnerability of Microsoft Lync Server software allows a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information.

A vulnerability that allows for remote execution of code exists in vulnerable components and is related to the processing of specially crafted font files. Exploiting this vulnerability enables remote execution of code, provided that the user opens a specially crafted file or webpage. Exploiting...

Design/Logic Flaw

Apple Type Services ATS in Apple OS X before 10.11.5 allows attackers to bypass intended FontValidator sandbox-policy restrictions and execute arbitrary code in a privileged context via a crafted app...

Microsoft Office Graphics Remote Code Execution Vulnerability

Microsoft Office is an office software suite of products developed by the U.S. company Microsoft Microsoft. Commonly used components are Word, Excel, Access, Powerpoint, FrontPage and so on. A remote code execution vulnerability exists in the Windows Font Library in Microsoft Office, which arises...

Microsoft Windows Win32k Elevation of Privilege (MS16-062: CVE-2016-0174)

A use after free vulnerability exists in Microsoft Windows that could be abused by attackers to elevate privileges. The vulnerability is caused when a font object is referenced after being deleted. A remote attacker can exploit this vulnerability by running a specially crafted application...

CVE-2016-0145

The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold and 1511; Office 2007 SP3 and 2010 SP2; Word Viewer; .NET Framework 3.0 SP2, 3.5, and 3.5.1; Skype for Business 2016;...

graphite2: Out-of-bounds read vulnerability in TfUtil:LocaLookup

A vulnerability has been discovered in Graphite2. An attacker able to trick an unsuspecting user into opening specially crafted font files in an application using Graphite2 could exploit these flaws to cause the application to crash or, potentially, execute arbitrary code with the privileges of t...

The vulnerability of the Graphite 2 rendering software allows a perpetrator to trigger a service failure or cause other adverse effects.

The vulnerability of the graphite2::TtfUtil::GetTableInfo function in the Graphite rendering software does not initialize memory for special data structures. Exploiting this vulnerability can allow a malicious actor to cause service failures or other effects using a specially created Graphite sma...

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

CachedCmap.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service buffer over-read or possibly have unspecified other impact via a crafted Graphite smart font...

DEBIAN-CVE-2016-2800

The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service buffer over-read or possibly have unspecified other impact via a crafted Graphite smart font,...

CVE-2016-1977

The Machine::Code::decoder::analysis::setref function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code or cause a denial of service stack memory corruption via a crafted Graphite smart font...

CVE-2016-1977

Summary: CVE-2016-1977 and related Graphite 2 vulnerabilities affect Graphite font rendering (library graphite2) used by Mozilla Firefox/Thunderbird. The issues stem from memory safety bugs in Graphite 2 (version 1.3.5 and earlier) that could allow remote code execution or crashes when processing...

Microsoft Windows OpenType Font Analysis Vulnerability (CNVD-2016-01568)

Microsoft Windows is a series of operating systems released by Microsoft.Adobe Type Manager Library is one of the font driver libraries. A remote code execution vulnerability exists in the Windows Adobe Type Manager Library for Microsoft Windows, which arises from the program not properly handlin...

Microsoft Windows OpenType Font Analysis Vulnerability (CNVD-2016-01569)

Microsoft Windows is a series of operating systems released by Microsoft.Adobe Type Manager Library is one of the font driver libraries. A security vulnerability exists in the Windows Adobe Type Manager Library for Microsoft Windows, which arises from a failure of the program to properly handle...

graphite2: multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)

The graphite2::TtfUtil::CmapSubtable12NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service buffer over-read or possibly have unspecified other impact via a crafted Graphite...

[SECURITY] [DSA 3477-1] iceweasel security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3477-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 14, 2016 https://www.debian.org/security/faq -...

Apple iOS/Safari/iTunes Memory Corruption Vulnerability (CNVD-2015-07152)

iOS is an operating system developed by Apple Inc. for mobile devices. safari is the browser in Mac OS X, the latest operating system for Apple computers. iTunes is a digital media playback application. A security vulnerability exists in CoreText in Apple iOS versions prior to 9.1, Safari version...