9365 matches found
GLSA-202211-09 : xterm: Arbitrary Code Execution
The remote host is affected by the vulnerability described in GLSA-202211-09 xterm: Arbitrary Code Execution - xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE...
Malicious code in font-firasans (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad02a833089b2dfde5d10b0ac271eebf5e1e2f1202e769e3cbd83e9e68fc1ca0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-3097 Malicious code in font-firasans (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad02a833089b2dfde5d10b0ac271eebf5e1e2f1202e769e3cbd83e9e68fc1ca0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
The vulnerability of Grub2 operating system loaders, related to the execution of operations outside the buffer boundaries, allows attackers to execute arbitrary code.
The vulnerability of Grub2 operating system loaders is related to the issue where operations occur outside of the buffer in memory when rendering certain Unicode sequences using a specially crafted font. Exploiting this vulnerability allows an attacker to execute arbitrary code...
The vulnerability of the grub_font_construct_glyph() function, a loader for the Grub2 operating system, allows a hacker to execute arbitrary code.
The vulnerability of the grubfontconstructglyph function, a part of the Grub2 operating system loader, is related to the issue where an operation goes beyond the buffer boundaries in memory when processing specially formatted glyphs in the pf2 format. Exploiting this vulnerability allows an...
grub2: Heap based out-of-bounds write when redering certain unicode sequences
A flaw was found in the grub2 font code. When rendering certain unicode sequences, it fails to properly validate the font width and height. These values are further used to access the font buffer, causing possible out-of-bounds writes. A malicious actor may craft a font capable of triggering this...
grub2: Buffer overflow in grub_font_construct_glyph() can lead to out-of-bound write and possible secure boot bypass
A flaw was found where a maliciously crafted pf2 font could lead to an out-of-bounds write in grub2. A successful attack can lead to memory corruption and secure boot circumvention...
xterm before 375 allows code execution via font ops e.g. because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.
...
UBUNTU-CVE-2022-45407
If an attacker loaded a font using FontFace on a background worker, a use-after-free could have occurred, leading to a potentially exploitable crash. This vulnerability affects Firefox 107...
[SECURITY] [DSA 5280-1] grub2 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-5280-1 [email protected] https://www.debian.org/security/ Steve McIntyre November 15, 2022 https://www.debian.org/security/faq -...
CVE-2022-3775
A flaw was found in the grub2 font code. When rendering certain unicode sequences, it fails to properly validate the font width and height. These values are further used to access the font buffer, causing possible out-of-bounds writes. A malicious actor may craft a font capable of triggering this...
CVE-2022-2601
A flaw was found where a maliciously crafted pf2 font could lead to an out-of-bounds write in grub2. A successful attack can lead to memory corruption and secure boot circumvention...
FreeType: Segmentation violation via FNT_Size_Request
A segmentation fault was found in the FreeType library. This flaw allows an attacker to attempt access to a memory location in a way that could cause an application to halt or crash, leading to a denial of service...
adobe-source-code-pro-fonts bug fix and enhancement update
An update is available for adobe-source-code-pro-fonts. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see...
grub2 缓冲区错误漏洞
grub2 is a Linux system boot program from the American GNU community. grub2 suffers from a buffer error vulnerability that stems from its font code presenting certain unicode sequences when it fails to properly validate the width and height of a font. These values are further used to access the...
Moderate: freetype security update
FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType loads, hints, and renders individual glyphs efficiently. Security Fixes: FreeType: Buffer overflow in sfntinitface CVE-2022-27404 FreeType: Segmentation violation via FNTSizeRequest CVE-2022-27405...
CVE-2022-31630
In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar function, the read outside allocated buffer will be used. This can lead to crashes or...
CVE-2022-45063
A flaw was found in xterm. This issue may allow code execution via font ops...
CVE-2022-31630
In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar function, the read outside allocated buffer will be used. This can lead to crashes or...
OESA-2022-2074 gnome-font-viewer security update
The Font Viewer application has been rewritten to match the new design used for GNOME 3 applications.It can now show an overview of all installed fonts and optimizes screen space usage when the application is maximized. Security Fixes: In texttoglyphs in sushi-font-widget.c in gnome-font-viewer...