Microsoft Windows Graphics Remote Code Execution Vulnerability (CNVD-2016-06273)

Microsoft Windows is the popular computer operating system. A remote code execution vulnerability exists in Microsoft Windows due to a font library that does not properly handle constructed embedded fonts. This vulnerability could be exploited by an attacker to take full control of an affected...

MS16-097: Security Update for Microsoft Graphics Component (3177393)

The remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities in the Graphics component due to improper handling of embedded fonts by the Windows font library. An unauthenticated, remote attacker can exploit these vulnerabilities, by convincing a use...

Microsoft Graphics Remote Code Execution Vulnerability

A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data...

Microsoft Graphics Remote Code Execution Vulnerability

A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data...

MGASA-2016-0264 Updated harfbuzz packages fix security vulnerability

Two memory access issues, including a heap-based buffer overflow CVE-2015-8947 and incorrect table length check CVE-2016-2052 could lead to a denial of service when rendering a crafted OpenType font...

chromium-browser: heap-buffer-overflow in sfntly

Heap-based buffer overflow in the ByteArray::Get method in data/bytearray.cc in Google sfntly before 2016-06-10, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SFNT font...

360 Mobile Browser Exploits Homologation Policy Bypass Vulnerability

360 Mobile Browser is a mobile browser based on the Android platform. A bypass same-origin policy vulnerability exists in 360 Mobile Browser version 7.0.0.44, which occurs when web fonts are downloaded without disabling cross-domain, resulting in the use of cross-domain fonts...

360 Security Browser Exploits Homologation Policy Bypass Vulnerability

360 Security Browser 360 Security Browser is a browser based on the dual kernel of IE and Chrome launched by 360 Security Center, a product of cooperation between Window of the World developer Phoenix Studio and 360 Security Center. A bypass same-origin policy vulnerability exists in 360 Security...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The package xfonts-100dpi-transcoded for the Debian GNU/Linux operating system has multiple vulnerabilities. Exploitation of these vulnerabilities may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

The vulnerability of the Firefox browser, which allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information.

The use of this feature after release in the FontTableRec destructor in Mozilla Firefox allows malicious actors operating remotely to execute arbitrary code by improperly using fonts contained in MathML, resulting in incorrect processing of the DirectWrite font object...

The vulnerability in the Firefox ESR software allows a malicious individual to compromise the confidentiality, integrity, and accessibility of protected information.

The use of this feature after release in FontTableRec in Mozilla Firefox ESR allows malicious actors operating remotely to execute arbitrary code by improperly using fonts contained in MathML, resulting in incorrect processing of the DirectWrite font object...

The vulnerability of Thunderbird software, which allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information.

The use of this tool after its release in FontTableRec within Mozilla Firefox, Firefox ESR, and Thunderbird allows malicious actors who operate remotely to execute arbitrary code by improperly handling the fonts contained in MathML. This leads to incorrect processing of the DirectWrite font objec...

The vulnerability of the Thunderbird email client, which allows a malicious actor to execute arbitrary code

Mozilla Thunderbird’s email client contains a vulnerability related to errors in the implementation of the cairotruetypeindextoucs4 function in the Cairo library. Exploiting this vulnerability allows malicious actors to execute arbitrary code using a specially crafted extension that processes fon...

The vulnerability of the Firefox browser, which allows a malicious actor to execute arbitrary code

The Mozilla Firefox browser contains a vulnerability related to the implementation of the cairotruetypeindextoucs4 function in the Cairo class. Exploiting this vulnerability allows malicious actors to execute arbitrary code remotely, using a specially crafted extension that processes fonts in PDF...

A year of Windows kernel font fuzzing #2: the techniques

Posted by Mateusz Jurczyk of Google Project Zero In part 1 of the series see here, we discussed the motivation and outcomes of our year long fuzzing effort against the Windows kernel font engine, followed by an analysis of two bug collisions with Keen Team and Hacking Team that ensued as a result...

Microsoft Windows Kernel - 'ATMFD.dll' NamedEscape 0x250C Pool Corruption (MS16-074)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=785 The Adobe Type Manager Font Driver ATMFD.DLL responsible for handling PostScript and OpenType fonts in the Windows kernel provides a channel of communication with user-mode applications via an undocumented gdi32!NamedEscape API...

Microsoft Windows - Kernel ATMFD.dll NamedEscape 0x250C Pool Corruption (MS16-074)

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=785 The Adobe Type Manager Font Driver ATMFD.DLL responsible for handling PostScript and OpenType fonts in the Windows kernel provides a channel of communication with user-mode...

Microsoft Windows Kernel - ATMFD.dll NamedEscape 0x250C Pool Corruption (MS16-074)

Microsoft Windows Kernel - ATMFD.dll NamedEscape 0x250C Pool Corruption MS16-074 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=785 The Adobe Type Manager Font Driver ATMFD.DLL responsible for handling PostScript and OpenType fonts in the Windows kernel provides a channel of...

CVE-2014-9747

The t42parseencoding function in type42/t42parse.c in FreeType before 2.5.4 does not properly update the current position for immediates-only mode, which allows remote attackers to cause a denial of service infinite loop via a Type42 font...

DEBIAN-CVE-2014-9746

The 1 t1parsefontmatrix function in type1/t1load.c, 2 cidparsefontmatrix function in cid/cidload.c, 3 t42parsefontmatrix function in type42/t42parse.c, and 4 psparserloadfield function in psaux/psobjs.c in FreeType before 2.5.4 do not check return values, which allows remote attackers to cause a...