Windows ATMFD.DLL CharString Stream Out-of-Bounds Reads

Source: https://code.google.com/p/google-security-research/issues/detail?id=382&can=1 We have encountered a number of Windows kernel crashes in the ATMFD.DLL OpenType driver while processing corrupted OTF font files, such as: --- DRIVERPAGEFAULTBEYONDENDOFALLOCATION d6 N bytes of memory was...

Microsoft Windows - ATMFD.DLL CFF table (ATMFD+0x34072 ATMFD+0x3407b) Invalid Memory Access

Microsoft Windows - ATMFD.DLL CFF table ATMFD+0x34072 ATMFD+0x3407b Invalid Memory Access Source: https://code.google.com/p/google-security-research/issues/detail?id=383&can=1 We have encountered a Windows kernel crash in the ATMFD.DLL OpenType driver while processing a corrupted OTF font file: -...

Microsoft Windows - ATMFD.dll CharString Stream Out-of-Bounds Reads (MS15-021)

Microsoft Windows - ATMFD.dll CharString Stream Out-of-Bounds Reads MS15-021 Source: https://code.google.com/p/google-security-research/issues/detail?id=382&can=1 We have encountered a number of Windows kernel crashes in the ATMFD.DLL OpenType driver while processing corrupted OTF font files, suc...

Windows ATMFD.DLL Out-of-Bounds Read Due to Malformed Name INDEX in the CFF Table Exploit

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=386&can=1 We have encountered a number of Windows kernel crashes in the ATMFD.DLL OpenType driver while processing corrupted OTF font files, such as: ---...

Microsoft Windows - ATMFD.DLL Out-of-Bounds Read Due to Malformed FDSelect Offset in the CFF Table

Microsoft Windows - ATMFD.DLL Out-of-Bounds Read Due to Malformed FDSelect Offset in the CFF Table Source: https://code.google.com/p/google-security-research/issues/detail?id=392&can=1 We have encountered a number of Windows kernel crashes in the ATMFD.DLL OpenType driver while processing corrupt...

Windows ATMFD.DLL CharString Stream Out-of-Bounds Reads Exploit

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=382&can=1 We have encountered a number of Windows kernel crashes in the ATMFD.DLL OpenType driver while processing corrupted OTF font files, such as: ---...

Windows ATMFD.DLL CFF table (ATMFD+0x3440b / ATMFD+0x3440e) Invalid Memory Access Exploit

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=384&can=1 We have encountered a number of Windows kernel crashes in the ATMFD.DLL OpenType driver while processing corrupted OTF font files, such as: ---...

Microsoft Windows - ATMFD.DLL Write to Uninitialized Address Due to Malformed CFF Table

Microsoft Windows - ATMFD.DLL Write to Uninitialized Address Due to Malformed CFF Table Source: https://code.google.com/p/google-security-research/issues/detail?id=385&can=1 We have encountered a number of Windows kernel crashes in the ATMFD.DLL OpenType driver while processing corrupted OTF font...

Windows ATMFD.DLL CFF table (ATMFD+0x34072 / ATMFD+0x3407b) Invalid Memory Access Exploit

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=383&can=1 We have encountered a Windows kernel crash in the ATMFD.DLL OpenType driver while processing a corrupted OTF font file: --- PAGEFAULTINNONPAGEDAREA 50 Invalid...

Microsoft Windows - ATMFD.dll CFF table (ATMFD+0x3440b ATMFD+0x3440e) Invalid Memory Access

Microsoft Windows - ATMFD.dll CFF table ATMFD+0x3440b ATMFD+0x3440e Invalid Memory Access Source: https://code.google.com/p/google-security-research/issues/detail?id=384&can=1 We have encountered a number of Windows kernel crashes in the ATMFD.DLL OpenType driver while processing corrupted OTF fo...

Microsoft Windows - 'ATMFD.DLL' CFF table (ATMFD+0x34072 / ATMFD+0x3407b) Invalid Memory Access

Source: https://code.google.com/p/google-security-research/issues/detail?id=383&can=1 We have encountered a Windows kernel crash in the ATMFD.DLL OpenType driver while processing a corrupted OTF font file: --- PAGEFAULTINNONPAGEDAREA 50 Invalid system memory was referenced. This cannot be protect...

Microsoft Windows - 'ATMFD.DLL' Out-of-Bounds Read Due to Malformed Name INDEX in the CFF Table

Source: https://code.google.com/p/google-security-research/issues/detail?id=386&can=1 We have encountered a number of Windows kernel crashes in the ATMFD.DLL OpenType driver while processing corrupted OTF font files, such as: --- DRIVERPAGEFAULTINFREEDSPECIALPOOL d5 Memory was referenced after it...

Microsoft Windows - 'ATMFD.DLL' Write to Uninitialized Address Due to Malformed CFF Table

Source: https://code.google.com/p/google-security-research/issues/detail?id=385&can=1 We have encountered a number of Windows kernel crashes in the ATMFD.DLL OpenType driver while processing corrupted OTF font files, such as: --- PAGEFAULTINNONPAGEDAREA 50 Invalid system memory was referenced. Th...

Microsoft Windows - 'ATMFD.DLL' Out-of-Bounds Read Due to Malformed FDSelect Offset in the CFF Table

Source: https://code.google.com/p/google-security-research/issues/detail?id=392&can=1 We have encountered a number of Windows kernel crashes in the ATMFD.DLL OpenType driver while processing corrupted OTF font files, such as: --- DRIVERPAGEFAULTINFREEDSPECIALPOOL d5 Memory was referenced after it...

Microsoft Graphics Component Remote Code Execution (MS15-080: CVE-2015-2461)

A remote code execution vulnerability has been reported in Windows Graphics Component. The vulnerability is due to the way Windows components handle specially crafted OTF files. A remote attacker can exploit this issue by enticing a user to view OTF files in shared content...

Microsoft Windows ATMFD Font Driver Kernel Pool Overflow (MS15-078: CVE-2015-2426)

A flaw has been discovered in Microsoft Windows OTF files. Successful exploitation could lead to a kernel pool overflow when a system attempt to copy data results in memory corruption...

CVE-2014-9662

cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via a crafted OTF font...

Heap overflow

cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via a crafted OTF font...

CVE-2014-9662

cff/cf2ft.c in FreeType before 2.5.4 does not validate the return values of point-allocation functions, which allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via a crafted OTF font...

CVE-2014-9662

FreeType vulnerability CVE-2014-9662 exists in cff/cf2ft.c up to version 2.5.3/2.5.4 timeframe: the code does not validate return values of point-allocation functions, enabling a remote attacker to craft an OTF font that triggers a heap-based buffer overflow (potential DoS or other impact). A fix...