OSV-2023-376 UNKNOWN WRITE in OT::Layout::GPOS_impl::CursivePosFormat1::subset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58660 Crash type: UNKNOWN WRITE Crash state: OT::Layout::GPOSimpl::CursivePosFormat1::subset hbsubsetcontextt::returnt OT::Layout::GPOSimpl::PosLookupSubTable::dispatch bool...

PT-2023-35814 · Git +1 · Harfbuzz

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN WRITE. The crash state involves the serialization of certain components, including...

PT-2023-35811 · Git +1 · Harfbuzz

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN WRITE. The crash state involves several function calls, including hb ot layout substitute start, hb ot...

CVE-2023-21492

Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR...

harfbuzz:hb-shape-fuzzer: Crash in hb_ot_layout_substitute_start

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5920994267889664 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-shape-fuzzer Job Type: libfuzzerasani386harfbuzz Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x08669764...

PT-2023-18246 · Samsung · Samsung Mobile Devices

Name of the Vulnerable Software and Affected Versions: Samsung Mobile Devices affected versions not specified Description: The issue allows a privileged local attacker to bypass ASLR due to kernel pointers being printed in the log file prior to SMR May-2023 Release 1. This is related to the...

CVE-2023-26397

Adobe Acrobat Reader versions 23.001.20093 and earlier and 20.005.30441 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue...

CVE-2023-26376

Adobe Dimension version 3.4.8 and earlier is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim...

Malicious Package

Overview yahoodotcom-layout is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...

Malicious code in yahoodotcom-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb0a9ae16cfadd970962e84bc11d082b5a7354335f88909193d51c5a759a1cfe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-980 Malicious code in yahoodotcom-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb0a9ae16cfadd970962e84bc11d082b5a7354335f88909193d51c5a759a1cfe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-26342

Adobe Dimension versions 3.4.7 and earlier is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim...

CVE-2023-26332

Adobe Dimension versions 3.4.7 and earlier is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim...

Fedora: Security Advisory for harfbuzz (FEDORA-2023-a48406ecd2)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 38 Update: harfbuzz-7.0.1-2.fc38

HarfBuzz is an implementation of the OpenType Layout engine...

PT-2023-1802 · Adobe · Dimension

Name of the Vulnerable Software and Affected Versions: Adobe Dimension versions 3.4.7 and earlier Description: The issue is related to an out-of-bounds read vulnerability in memory, which could allow an attacker to gain unauthorized access to protected information. This vulnerability may lead to...

Fedora 38 : cairo / freetype / harfbuzz / qt6-qtwebengine (2023-a48406ecd2)

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-a48406ecd2 advisory. Security fix for CVE-2023-25193 Update of HarfBuzz to 7.0.1 version 2169172 Update of freetype to 2.13.0 version 2168496 ---- Security fix for...

PT-2023-1921 · Adobe · Dimension

Name of the Vulnerable Software and Affected Versions: Adobe Dimension versions 3.4.7 and earlier Description: The issue is related to an out-of-bounds read vulnerability in Adobe Dimension, which could lead to the disclosure of sensitive memory. This vulnerability can be exploited by an attacker...

Adobe InDesign Buffer Overflow DoS

The vulnerability of Adobe InDesign’s computer layout automation tool is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a system failure...

Debian: Security Advisory (DSA-1751-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...