stb assertion failure vulnerability

stb is a C/C++ library consisting of a single file. An assertion failure vulnerability exists in stbttcffgetindex in stbtruetype.h in stb 1.22 and earlier. An attacker can exploit this vulnerability to cause a denial of service...

CVE-2020-6623

stb stbtruetype.h through 1.22 has an assertion failure in stbttcffgetindex...

CVE-2020-6617

stb stbtruetype.h through 1.22 has an assertion failure in stbttcffint...

UBUNTU-CVE-2020-6623

stb stbtruetype.h through 1.22 has an assertion failure in stbttcffgetindex...

freetype2:cff-render-ftengine: Invalid-builtin-use in FT_Outline_Get_Orientation

Detailed Report: https://oss-fuzz.com/testcase?key=5735696199581696 Project: freetype2 Fuzzing Engine: libFuzzer Fuzz Target: cff-render-ftengine Job Type: libfuzzerubsanfreetype2 Platform Id: linux Crash Type: Invalid-builtin-use Crash Address: Crash State: FTOutlineGetOrientation...

Adobe Acrobat Reader DC for Windows - Use of Uninitialized Pointer due to Malformed OTF Font (CFF Table)

We have observed the following access violation exception in the latest version of Adobe Acrobat Reader DC for Windows, when opening a malformed PDF file: --- cut --- 5708.4564: Access violation - code c0000005 first chance First chance exceptions are reported before any exception handling. This...

Adobe Acrobat Reader DC for Windows - Use of Uninitialized Pointer due to Malformed OTF Font (CFF Table)

Adobe Acrobat Reader DC for Windows - Use of Uninitialized Pointer due to Malformed OTF Font CFF Table We have observed the following access violation exception in the latest version of Adobe Acrobat Reader DC for Windows, when opening a malformed PDF file: --- cut --- 5708.4564: Access violation...

Microsoft DirectWrite AFDKO - Out-of-Bounds Read in OpenType Font Handling Due to Undefined FontName Index

Microsoft DirectWrite AFDKO - Out-of-Bounds Read in OpenType Font Handling Due to Undefined FontName Index -----===== Background =====----- AFDKO Adobe Font Development Kit for OpenType is a set of tools for examining, modifying and building fonts. The core part of this toolset is a font handling...

Microsoft DirectWrite AFDKO - Stack Corruption in OpenType Font Handling While Processing CFF Blend DICT Operator

Microsoft DirectWrite AFDKO - Stack Corruption in OpenType Font Handling While Processing CFF Blend DICT Operator -----===== Background =====----- AFDKO Adobe Font Development Kit for OpenType is a set of tools for examining, modifying and building fonts. The core part of this toolset is a font...

Microsoft DirectWrite / AFDKO - Stack Corruption in OpenType Font Handling While Processing CFF Blend DICT Operator

-----===== Background =====----- AFDKO Adobe Font Development Kit for OpenType is a set of tools for examining, modifying and building fonts. The core part of this toolset is a font handling library written in C, which provides interfaces for reading and writing Type 1, OpenType, TrueType to some...

harfbuzz/hb-subset-fuzzer: Use-of-uninitialized-value in hb_vector_t<unsigned char, 1u>::resize

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5711849555755008 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-subset-fuzzer Fuzz target binary: hb-subset-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type:...

harfbuzz/hb-subset-fuzzer: Use-of-uninitialized-value in CFF::InterpEnv<CFF::Number>::fetch_op

Detailed report: https://oss-fuzz.com/testcase?key=5756332481708032 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-subset-fuzzer Fuzz target binary: hb-subset-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

harfbuzz/hb-shape-fuzzer: Use-of-uninitialized-value in CFF::Charset1_2<OT::IntType<unsigned char, 1u> >::get_glyph

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5632586529898496 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-shape-fuzzer Fuzz target binary: hb-shape-fuzzer Job Type: libfuzzermsanharfbuzz Platform Id: linux Crash Type:...

harfbuzz/hb-subset-fuzzer: Global-buffer-overflow in CFF::BlendArg::set_blends

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5710107829075968 Project: harfbuzz Fuzzer: aflharfbuzzhb-subset-fuzzer Fuzz target binary: hb-subset-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: Global-buffer-overflow READ 8...

harfbuzz/hb-subset-fuzzer: Heap-buffer-overflow in CFF::CFF2VariationStore::serialize

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5660711141769216 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-subset-fuzzer Fuzz target binary: hb-subset-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflo...

harfbuzz/hb-shape-fuzzer: Global-buffer-overflow in CFF::BlendArg::set_blends

Project: https://github.com/harfbuzz/harfbuzz.git Detailed report: https://oss-fuzz.com/testcase?key=5686369209286656 Project: harfbuzz Fuzzer: libFuzzerharfbuzzhb-shape-fuzzer Fuzz target binary: hb-shape-fuzzer Job Type: libfuzzerasanharfbuzz Platform Id: linux Crash Type: Global-buffer-overflo...

freetype2/cff-ftengine: Crash in cff_decoder_parse_charstrings

Detailed report: https://oss-fuzz.com/testcase?key=5709686410575872 Project: freetype2 Fuzzer: libFuzzerfreetype2cff-ftengine Fuzz target binary: cff-ftengine Job Type: libfuzzerasanfreetype2 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7fa03f210910 Crash State:...

freetype2/cff: Heap-buffer-overflow in tt_face_palette_set

Detailed report: https://oss-fuzz.com/testcase?key=5745733882347520 Project: freetype2 Fuzzer: aflfreetype2cff Fuzz target binary: cff Job Type: aflasanfreetype2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x617000000a74 Crash State: ttfacepaletteset ttfaceloadcpal...

freetype2/cff-render: Heap-buffer-overflow in tt_face_palette_set

Detailed report: https://oss-fuzz.com/testcase?key=5278718313365504 Project: freetype2 Fuzzer: aflfreetype2cff-render Fuzz target binary: cff-render Job Type: aflasanfreetype2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x61f0000028d8 Crash State: ttfacepaletteset...

freetype2/cff: Heap-buffer-overflow in cff_parser_run

Detailed report: https://oss-fuzz.com/testcase?key=5731555572973568 Project: freetype2 Fuzzer: libFuzzerfreetype2cff Fuzz target binary: cff Job Type: libfuzzerasanfreetype2 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x6080000005f3 Crash State: cffparserrun...