9453 matches found
@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name
Summary Embedded font-family names word/fontTable.xml were interpolated unescaped into an injected @font-face and into the print window's document.write. A crafted name injects page-wide CSS on open, and breaks out of into executable HTML on Print. Impact Opening a crafted .docx applies...
BrokenType
BrokenType BrokenType 是一套用于测试字体光栅化软件鲁棒性和安全性的工具集，尤其针对容易出现内存损坏问题的代码库（例如基于 C/C++ 及其类似语言编写的）。它包含以下组件： TrueType 程序生成器 - 一个 Python 脚本，用于生成随机但有效的 TrueType 程序。 TTF/OTF 变异器 - 一个用 C++ 编写的半“智能”二进制字体文件变异器。 Windows GDI 的 TTF/OTF 加载器 - 一个用于通过 Windows GDI/Uniscribe 加载和测试自定义字体的实用工具。 DirectWrite 的 TTF/OTF 加载器 -...
CVE-2026-44950
fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...
CVE-2026-59679
fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...
CVE-2026-44950
fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...
EUVD-2026-75306
fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...
CVE-2026-44950
CVE-2026-44950 is a heap buffer overflow in the libXfont2 font-server client (fs_read_glyphs() in src/fc/fserve.c). The function validates each glyph's source slice individually but never checks whether the cumulative destination offset exceeds the allocated buffer size. A malicious font server c...
CVE-2026-44950 fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2
fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...
EUVD-2026-75300
fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...
CVE-2026-59679 fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2
fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...
CVE-2026-59679
CVE-2026-59679 affects the libXfont2 font-server client (X.Org X11). The function fs_read_glyphs() in src/fc/fserve.c indexes the encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated based on num_extents from the separate FS_QueryXExtents16 reply—two fi...
CVE-2026-59679
fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...
CVE-2026-79515
A flaw was found in the stb component. An out-of-bounds read vulnerability in the stbttGetGlyphShape function allows a remote attacker to cause a Denial of Service DoS by sending a specially crafted TrueType Font TTF file. This can lead to the affected application becoming unresponsive or crashin...
dompdf-rce
Exploit de RCE para dompdf Este repositorio contiene una aplicación de demostración vulnerable que utiliza dompdf 1.2.0 y un exploit que logra ejecución remota de código mediante un archivo políglota ttf+php. Para más detalles, visite https://positive.security/blog/dompdf-rce Instrucciones 1...
CVE-2026-79591
A heap-buffer-overflow and use-after-free vulnerability exists in the xlsgetCSS function of libxls 1.6.3 due to insufficient validation of a file-controlled font index...
CVE-2026-79591
A heap-buffer-overflow and use-after-free vulnerability exists in the xls_getCSS() function of libxls 1.6.3 , caused by insufficient validation of a file-controlled font index. A potential fix is referenced in a GitHub pull request (libxls PR #164 ), alongside issue #161 . No CVSS metrics or conf...
EUVD-2026-75745
A heap-buffer-overflow and use-after-free vulnerability exists in the xlsgetCSS function of libxls 1.6.3 due to insufficient validation of a file-controlled font index...
nexts-cve-2025-66478-exploit
这是一个使用 create-next-app 引导的 Next.js 项目。 快速开始 首先，运行开发服务器： root@kitploit: npm run dev or yarn dev or pnpm dev or bun dev 在浏览器中打开 http://localhost:3000 查看结果。 你可以通过修改 app/page.tsx 来编辑页面。当你编辑文件时，页面会自动更新。 该项目使用 next/font 自动优化和加载 Geist，这是 Vercel 的一个新字体家族。 了解更多 要了解更多关于 Next.js 的信息，请查看以下资源： Next.js 文档 - 了解...
CVE-2025-63708
CVE-2025-63708 CVE ID: CVE-2025-63708 分配日期: 2025-12-11 问题类型: CWE-79（跨站脚本） 受影响产品: “AI Font Matcher”（发布于2025-10-10，nid=18425） 产品页面: https://www.sourcecodester.com/javascript/18425/ai-font-matcher-using-html-css-and-javascript-source-code.html 发现日期: 2025-10-11 研究人员: Dylan Davis 概要 该应用程序在处理来自 webfont...