CVE-2020-27931

CVE-2020-27931 affects Apple’s FontParser/CoreText stack on macOS/iOS/watchOS/tvOS, where a memory corruption issue in parsing font files can lead to arbitrary code execution. The root cause is an input-validation weakness while processing font data (TTF fonts), enabling maliciously crafted fonts...

CVE-2020-27931

A memory corruption issue existed in the processing of font files. This issue was addressed with improved input validation. This issue is fixed in iOS 14.0 and iPadOS 14.0, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1, watchOS 7.0,...

CVE-2020-27922

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, watchOS 7.1, tvOS 14.2. Processing a maliciously crafted font file may lead to...

CVE-2020-27922

CVE-2020-27922 is a logic issue in Apple’s font processing pathway (CoreText/FontParser) that could allow arbitrary code execution when parsing a maliciously crafted font file. The issue is fixed in macOS Big Sur 11.1 and corresponding security updates: Catalina 10.15.7 (Security Update 2020-001)...

CVE-2020-9956

CVE-2020-9956 is an out-of-bounds/memory handling issue affecting Apple font parsing components (FontParser/CoreText) where processing a maliciously crafted font file could lead to arbitrary code execution. The vulnerability is addressed in Apple security updates for macOS Big Sur 11.0.1, macOS B...

CVE-2020-9956

An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, tvOS 14.0, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, watchOS 7.0, iOS 14.0 and iPadOS 14.0. Processing a maliciously crafted font file may...

Apple iOS和Apple iPadOS 缓冲区错误漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS 14.0 and iPadOS prior to 14.0, which stems from the handling of maliciously...

Who has the fastest F1 website in 2021? Part 5

This is part 5 in a multi-part series looking at the loading performance of F1 websites. Not interested in F1? It shouldn't matter. This is just a performance review of 10 recently-built/updated sites that have broadly the same goal, but are built by different teams, and have different performanc...

The vulnerability of the OpenType Font Parsing component in Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the OpenType Font Parsing component in Windows operating systems is related to improper handling of code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending a specially crafted request...

CVE-2021-26876

OpenType Font Parsing Remote Code Execution Vulnerability...

CVE-2021-26876

OpenType Font Parsing Remote Code Execution Vulnerability...

Remote code execution

OpenType Font Parsing Remote Code Execution Vulnerability...

CVE-2021-26876 OpenType Font Parsing Remote Code Execution Vulnerability

...

CVE-2021-26876

CVE-2021-26876 is an OpenType Font Parsing Remote Code Execution vulnerability. Connected sources indicate it affects Windows components (notably the Windows Graphics Component) with a high impact (CVSSv3.1 8.8) and network attack vector. The vulnerability enables remote code execution and is add...

OpenType Font Parsing Remote Code Execution Vulnerability

...

Microsoft Windows OpenType Font Parsing 代码注入漏洞

Microsoft Windows is a suite of operating systems used by Microsoft Corporation USA for personal devices. A code injection vulnerability exists in Microsoft Windows OpenType Font Parsing. The following products and editions are affected:Windows 10 Version 1803 for ARM64-based Systems,Windows 10...

PT-2021-2396 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to incorrect code generation management in the OpenType Font Parsing component of Windows operating systems. It allows remote attackers to execute arbitrary code by...

MGASA-2021-0112 Updated xpdf packages fix security vulnerabilities

In Xpdf 4.02, SplashOutputDev::endType3CharGfxState state SplashOutputDev.cc:3079 is trying to use the freed t3GlyphStack-cache, which causes an heap-use-after-free problem. The codes of a previous fix for nested Type 3 characters wasn't correctly handling the case where a Type 3 char referred to...

Updated xpdf packages fix security vulnerabilities

In Xpdf 4.02, SplashOutputDev::endType3CharGfxState state SplashOutputDev.cc:3079 is trying to use the freed t3GlyphStack-cache, which causes an heap-use-after-free problem. The codes of a previous fix for nested Type 3 characters wasn't correctly handling the case where a Type 3 char referred to...

PT-2021-3150 · Microsoft · Windows Graphics +1

Name of the Vulnerable Software and Affected Versions: Windows Graphics Component affected versions not specified Description: The issue is related to the incorrect handling of Font Entry objects, which can allow an attacker to elevate their privileges. This can affect the system, potentially...