Microsoft Windows Kernel - win32k.sys .TTF Font Processing Out-of-Bounds Read with Malformed glyf Table win32k!fsc_CalcGrayRow (Denial of Service)

Microsoft Windows Kernel - win32k.sys .TTF Font Processing Out-of-Bounds Read with Malformed glyf Table win32k!fscCalcGrayRow Denial of Service Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1274 We have encountered a number of Windows kernel crashes in the win32k.sys driver...

Microsoft Windows Kernel - win32k.sys .TTF Font Processing Out-of-Bounds ReadsWrites with Malformed fpgm table win32k!bGeneratePath (Denial of Service)

Microsoft Windows Kernel - win32k.sys .TTF Font Processing Out-of-Bounds ReadsWrites with Malformed fpgm table win32k!bGeneratePath Denial of Service Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1273 We have encountered a number of Windows kernel crashes in the win32k.sys...

Microsoft Windows Kernel - win32k.sys TTF Font Processing Out-of-Bounds Read with Malformed Exploit

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1274 We have encountered a number of Windows kernel crashes in the win32k.sys driver while processing corrupted TTF font files: --- PAGEFAULTINNONPAGEDAREA 50 Invalid system memory...

Microsoft Windows Kernel - win32k.sys TTF Font Processing - Out-of-Bounds Reads/Writes with Malforme

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1273 We have encountered a number of Windows kernel crashes in the win32k.sys driver while processing corrupted TTF font files. The most frequent one occurring for the bug reported...

Microsoft Windows Kernel - 'win32k.sys' '.TTF' Font Processing Out-of-Bounds Reads/Writes with Malformed 'fpgm' table 'win32k!bGeneratePath' (Denial of Service)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1273 We have encountered a number of Windows kernel crashes in the win32k.sys driver while processing corrupted TTF font files. The most frequent one occurring for the bug reported here is as follows: --- PAGEFAULTINNONPAGEDAREA 50...

Microsoft Win32k Graphics Remote Code Execution (CVE-2017-8682)

A remote code execution vulnerability exists in Windows font library. The vulnerability is due to the way Windows font library improperly handles specially crafted embedded fonts. A remote attacker can exploit this vulnerability by enticing a target user to open a specially crafted TTF file...

Adobe Acrobat and Reader Memory Corruption (APSB17-24: CVE-2017-11210)

A memory corruption vulnerability exists in Adobe Reader and Acrobat. The vulnerability is due to error while parsing fonts embedded in TTF file. A remote attacker can exploit this vulnerability for unintended reads potentially leading to information leak attack...

SWFTools Denial of Service Vulnerability (CNVD-2017-15100)

SWFTools is a utility toolset for working with Adobe Flash files SWF files. A denial of service vulnerability exists in version 2013-04-09-1007 of SWFTools for Windows-based platforms. A remote attacker can exploit this vulnerability to cause a denial of service with malformed TTF files...

SWFTools 'readBlock()' heap buffer read vulnerability

SWFTools is a suite of open source software tools for creating and manipulating SWF files. A heap buffer read vulnerability exists in the 'readBlock' function of the lib/ttf.c file in SWFTools version 0.9.2. The vulnerability can be exploited to cause a heap buffer out-of-bounds read with the hel...

CVE-2017-10976

When SWFTools 0.9.2 processes a crafted file in ttftool, it can lead to a heap-based buffer over-read in the readBlock function in lib/ttf.c...

CVE-2017-8420

SWFTools 2013-04-09-1007 on Windows has a "Data from Faulting Address controls Branch Selection starting at image0000000000400000+0x0000000000003e71" issue. This issue can be triggered by a malformed TTF file that is mishandled by font2swf. Attackers could exploit this issue for DoS Access...

Code injection

SWFTools 2013-04-09-1007 on Windows has a "Data from Faulting Address controls Branch Selection starting at image0000000000400000+0x0000000000003e71" issue. This issue can be triggered by a malformed TTF file that is mishandled by font2swf. Attackers could exploit this issue for DoS Access...

CVE-2017-8420

SWFTools 2013-04-09-1007 on Windows has a "Data from Faulting Address controls Branch Selection starting at image0000000000400000+0x0000000000003e71" issue. This issue can be triggered by a malformed TTF file that is mishandled by font2swf. Attackers could exploit this issue for DoS Access...

CVE-2017-8420

Removed by vendor...

CVE-2017-8420

SWFTools 2013-04-09-1007 on Windows is affected by a DoS vulnerability where a malformed TTF file mishandled by font2swf causes an access violation (Data from Faulting Address controls Branch Selection at image00000000_00400000+0x0000000000003e71). The issue’s root cause is in the font processing...

Microsoft Windows - USP10!SubstituteNtoM Uniscribe Font Processing Out-of-Bounds Memory Read

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1200 We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!SubstituteNtoM function, while trying to display text using a corrupted TTF font file: ---...

Microsoft Windows - USP10!otlSinglePosLookup::getCoverageTable Uniscribe Font Processing Out-of-Boun

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1203 We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!otlSinglePosLookup::getCoverageTable function, while trying to display text using a...

Microsoft Windows - USP10!otlReverseChainingLookup::apply Uniscribe Font Processing Out-of-Bounds Me

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1205 We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!otlReverseChainingLookup::apply function, while trying to display text using a corrupted T...

Microsoft Windows Uniscribe Information Disclosure Vulnerability(CVE-2017-0285)

We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!SubstituteNtoM function, while trying to display text using a corrupted TTF font file: --- 69c.164: Access violation - code c0000005 first chance First chance exceptions are reported before any exception handling...

Microsoft Windows Graphics Component Information Disclosure Vulnerability(CVE-2017-0286 )

We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!NextCharInLiga function, while trying to display text using a corrupted TTF font file: --- 3d4.454: Access violation - code c0000005 first chance First chance exceptions are reported before any exception handling...