WS-2020-0378

HarfBuzz in versions 2.3.0 to 2.7.0 is vulnerable to global-buffer-overflow in OT::VarData::getscalars, related to src/hb-cff2-interp-cs.hh...

harfbuzz:hb-shape-fuzzer: Use-of-uninitialized-value in CFF::cff2_cs_opset_t<cff2_cs_opset_extents_t, cff2_extents_param_t, CFF::number_

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5027031316496384 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-shape-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

harfbuzz:hb-subset-fuzzer: Use-of-uninitialized-value in CFF::cff2_cs_opset_t<cff2_cs_opset_subr_subset_t, CFF::subr_subset_param_t, CFF:

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5291661985120256 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-subset-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

Security update for freetype2

This update for freetype2 fixes the following issues: CVE-2025-23022: signed integer overflow in cf2doFlex in cff/cf2intrp.c. bsc1235670 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can ru...

harfbuzz:hb-draw-fuzzer: Use-of-uninitialized-value in CFF::cff2_cs_opset_t<cff2_cs_opset_path_t, cff2_path_param_t, CFF::number_t, cff

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5647032962580480 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-draw-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

SUSE CVE-2025-23022

FreeType 2.8.1 has a signed integer overflow in cf2doFlex in cff/cf2intrp.c...

Adobe Acrobat Reader Font CharStrings CharStringsOffset out-of-bounds read vulnerability

Talos Vulnerability Report TALOS-2023-1910 Adobe Acrobat Reader Font CharStrings CharStringsOffset out-of-bounds read vulnerability February 15, 2024 CVE Number CVE-2024-20749 SUMMARY An out-of-bounds read vulnerability exists in the font file processing functionality of Adobe Acrobat Reader...

OSV-2023-1272 Heap-buffer-overflow in OT::cff2::accelerator_templ_t<CFF::cff2_private_dict_opset_t, CFF::cff2_private_

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64859 Crash type: Heap-buffer-overflow READ 2 Crash state: OT::cff2::acceleratortempltCFF::cff2privatedictopsett, CFF::cff2private hbotdrawglyph hbfontdrawglyph...

harfbuzz:hb-draw-fuzzer: Heap-buffer-overflow in OT::cff2::accelerator_templ_t<CFF::cff2_private_dict_opset_t, CFF::cff2_private_

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5393832740782080 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-draw-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

PT-2021-27643

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ crash occurred, involving the CFF2VariationStore::serialize function, specifically in the write cff2 and hb subset cff2...

PT-2020-21898

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash caused by a global buffer overflow write. The crash occurs in the OT::VarData::get scalars and OT::VariationStore::get...

OSV-2020-704 Heap-buffer-overflow in BEInt<unsigned char, 1>::set

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13736 Crash type: Heap-buffer-overflow WRITE 1 Crash state: BEInt::set CFF::CFFIndex ::setoffsetat bool CFF::FDArray ::serializeCFF::cff2fontdict...

PT-2020-22490

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap buffer overflow error, specifically a WRITE 1 crash type. The crash occurs in the BEInt::set function, which is called by...