In read_paint of ttcolr.c there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-254803162

...

CVE-2023-20958

In readpaint of ttcolr.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-2548031...

AZL-26758 CVE-2023-20958 affecting package qt5-qtbase for versions less than 5.12.11-5

In readpaint of ttcolr.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-2548031...

Heap overflow

In readpaint of ttcolr.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-2548031...

ASB-A-254803162

In readpaint of ttcolr.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

OSV-2021-602 Heap-buffer-overflow in read_paint

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32913 Crash type: Heap-buffer-overflow READ 1 Crash state: readpaint ttfacegetpaint FTGetPaint...

freetype2:colrv1: Heap-buffer-overflow in read_paint

Detailed Report: https://oss-fuzz.com/testcase?key=4704166036504576 Project: freetype2 Fuzzing Engine: libFuzzer Fuzz Target: colrv1 Job Type: libfuzzerasanfreetype2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x62a000011fe4 Crash State: readpaint ttfacegetpaint...