CVE-2016-1523 The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows....
MediumCVSS 6.5
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/graphite2(Debian:12) | < 1.3.5-1 | 1.3.5-1 |
| debian/graphite2(Debian:13) | < 1.3.5-1 | 1.3.5-1 |
| debian/graphite2(Debian:14) | < 1.3.5-1 | 1.3.5-1 |
| fedoraproject fedora | = 22 | No fix listed |
| fedoraproject fedora | = 23 | No fix listed |
| mozilla Firefox | = 38.0 | No fix listed |
| mozilla Firefox | = 38.0.1 | No fix listed |
| mozilla Firefox | = 38.0.5 | No fix listed |
| mozilla Firefox | = 38.1.0 | No fix listed |
| mozilla Firefox | = 38.1.1 | No fix listed |
| mozilla Firefox | = 38.2.0 | No fix listed |
| mozilla Firefox | = 38.2.1 | No fix listed |
| mozilla Firefox | = 38.3.0 | No fix listed |
| mozilla Firefox | = 38.4.0 | No fix listed |
| mozilla Firefox | = 38.5.0 | No fix listed |
| mozilla Firefox | = 38.5.1 | No fix listed |
| mozilla Firefox | = 38.5.2 | No fix listed |
| mozilla Firefox | = 38.6.0 | No fix listed |
| mozilla Thunderbird | <= 38.5.1 | No fix listed |
| sil graphite2 | = 1.2.4 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
References
- Debian Security Tracker CVE-2016-1523 vendor-advisory
- blog.talosintel.com
- FEDORA-2016-4154a4d0ba third-party-advisory vendor-advisory
- FEDORA-2016-338a7e9925 third-party-advisory vendor-advisory
- SUSE-SU-2016:0554 vendor-advisory
- SUSE-SU-2016:0564 vendor-advisory
- SUSE-SU-2016:0779 vendor-advisory
- openSUSE-SU-2016:0791 vendor-advisory
- openSUSE-SU-2016:0875 vendor-advisory
- RHSA-2016:0197 vendor-advisory
- RHSA-2016:0258 vendor-advisory
- RHSA-2016:0594 vendor-advisory
- DSA-3477 vendor-advisory
- DSA-3479 third-party-advisory vendor-advisory
- DSA-3491 vendor-advisory
- www.mozilla.org patch vendor-advisory
- www.oracle.com
- www.oracle.com
- 82991 vdb-entry
- 1035017 vdb-entry
- USN-2902-1 vendor-advisory
- USN-2904-1 vendor-advisory
- bugzilla.mozilla.org issue-tracking
- GLSA-201605-06 vendor-advisory
- GLSA-201701-35 vendor-advisory
- GLSA-201701-63 vendor-advisory