August Patch Tuesday: 25 critical Microsoft vulnerabilities, 43 for Adobe

Today Microsoft released patches covering 48 vulnerabilities as part of August’s Patch Tuesday update, with 15 of them affecting Windows. Patches covering 25 of these vulnerabilities are labeled as Critical, and 27 can result in Remote Code Execution. According to Microsoft, none of these...

Express Compressed Fonts Remote Code Execution Vulnerability

A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits exploited this vulnerability would gain code execution on the target system. Users whose accounts are configured to have fewer user...

Security update for the Express Compressed Fonts remote code execution vulnerability in Windows Server 2008: August 8, 2017

Security update for the Express Compressed Fonts remote code execution vulnerability in Windows Server 2008: August 8, 2017 Summary A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits...

Adobe Acrobat and Reader Type Confusion (APSB17-24: CVE-2017-11221)

A type confusion overflow vulnerability exists in Adobe Acrobat and Reader. The vulnerability is due to the way Adobe processes font locations. A remote attacker may exploit this vulnerability by enticing a target user to open a specially crafted PDF file...

Adobe Acrobat and Reader Memory Corruption (APSB17-24: CVE-2017-11210)

A memory corruption vulnerability exists in Adobe Reader and Acrobat. The vulnerability is due to error while parsing fonts embedded in TTF file. A remote attacker can exploit this vulnerability for unintended reads potentially leading to information leak attack...

Microsoft Windows Express Compressed Fonts CVE-2017-8691 Remote Code Execution Vulnerability

Description Microsoft Windows font library is prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code in the context of an affected system. Failed exploit attempts may result in a denial of service condition. Technologies Affected Microsoft...

Adobe Acrobat Pro DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

EulerOS 2.0 SP2 : graphite2 (EulerOS-SA-2017-1153)

According to the versions of the graphite2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Various vulnerabilities have been discovered in Graphite2. An attacker able to trick an unsuspecting user into opening specially crafted font...

Mitsubishi Electric E-Designer SetupAlarm Font Property Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Mitsubishi Electric E-Designer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

Artifex Ghostscript GhostXPS heap buffer overflow vulnerability (CNVD-2017-22386)

Artifex Ghostscript is an open source PostScript a page description language and programming language for the electronics industry and desktop publishing parser from Artifex Software. Artifex Ghostscript A security vulnerability exists in the 'xpsdecodefontcharimp' function of the xps/xpsfont.c...

Artifex Ghostscript GhostXPS heap buffer overflow vulnerability (CNVD-2017-22389)

Artifex Ghostscript is an open source PostScript a page description language and programming language for the electronics industry and desktop publishing parser from Artifex Software. Artifex Ghostscript A security vulnerability exists in the 'xpsselectfontencoding' function of the xps/xpsfont.c...

DEBIAN-CVE-2017-9610

The xpsloadsfntname function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash or possibly have unspecified other impact via a crafted document...

CVE-2017-9610

The xpsloadsfntname function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash or possibly have unspecified other impact via a crafted document...

WordPress Arabic Font Plugin Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Arabic Font plugin. An attacker can exploit this vulnerability t...

MGASA-2017-0217 Updated graphite2 packages fix security vulnerabilities

An out-of-bounds write triggered with a maliciously crafted Graphite font could lead to a crash or potentially code execution CVE-2017-5436. Multiple vulnerabilities have been found in the Graphite font rendering engine which might result in denial of service or the execution of arbitrary code if...

Updated graphite2 packages fix security vulnerabilities

An out-of-bounds write triggered with a maliciously crafted Graphite font could lead to a crash or potentially code execution CVE-2017-5436. Multiple vulnerabilities have been found in the Graphite font rendering engine which might result in denial of service or the execution of arbitrary code if...

FontForge buffer overflow vulnerability (CNVD-2017-18365)

FontForge is an open source font editing tool that supports multiple languages. A buffer overflow vulnerability exists in PSCharStringToSplines in FontForge version 20161012. An attacker can exploit this vulnerability to cause a denial of service or code execution with the help of a specially...

FontForge buffer overflow vulnerability (CNVD-2017-18538)

FontForge is an open source font editing tool that supports multiple languages. A buffer overflow vulnerability exists in ValidatePostScriptFontName in FontForge version 20161012. An attacker can exploit this vulnerability with a specially crafted otf file to cause a denial of service or execute...

ImageMagick Denial of Service Vulnerability (CNVD-2017-18361)

ImageMagick is a set of open-source image processing software from the U.S. company ImageMagick Studio. The software can read, convert and write pictures in a variety of formats. A denial of service vulnerability exists in the 'litefontmap' function in the coders/wmf.c file in ImageMagick version...

FontForge Buffer Overflow Vulnerability

FontForge is an open source font editing tool that supports multiple languages. A buffer overflow vulnerability exists in getsid in FontForge version 20161012. An attacker can exploit this vulnerability with a specially crafted otf file to cause a denial of service or code execution...