Mozilla Foundation Security Advisory 2016-37
Font vulnerabilities in the Graphite 2 library
- Announced
- March 8, 2016
- Reporter
- Holger Fuhrmannek, Tyson Smith
- Impact
- Critical
- Products
- Firefox, Firefox ESR, Thunderbird
- Fixed in
-
- Firefox 45
- Firefox ESR 38.7
- Thunderbird 38.7
- Thunderbird 45
Description
Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5.
The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded.
Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts.
To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6.
References
- Graphite2 Machine::Code::decoder::analysis::set_ref stack out of bounds bit set (CVE-2016-1977)
- Use of uninitialised memory in [@graphite2::TtfUtil::GetTableInfo] (CVE-2016-2790)
- graphite2: heap-buffer-overflow read in [@graphite2::GlyphCache::glyph] (CVE-2016-2791)
- graphite2: heap-buffer-overflow read in [@graphite2::Slot::getAttr] Slot.cpp:232 (CVE-2016-2792)
- graphite2: heap-buffer-overflow read in CachedCmap.cpp (CVE-2016-2793)
- graphite2: heap-buffer-overflow read in [@graphite2::TtfUtil::CmapSubtable12NextCodepoint] (CVE-2016-2794)
- Use of uninitialised memory in [@graphite2::FileFace::get_table_fn] (CVE-2016-2795)
- graphite2: heap-buffer-overflow write in [@graphite2::vm::Machine::Code::Code] (CVE-2016-2796)
- graphite2: heap-buffer-overflow read in [@graphite2::TtfUtil::CmapSubtable12Lookup] (CVE-2016-2797)
- graphite2: heap-buffer-overflow read in [@graphite2::GlyphCache::Loader::Loader] (CVE-2016-2798)
- graphite2: heap-buffer-overflow write in [@graphite2::Slot::setAttr] (CVE-2016-2799)
- graphite2: heap-buffer-overflow read in [@graphite2::Slot::getAttr] Slot.cpp:234 (CVE-2016-2800)
- graphite2: heap-buffer-overflow read in [@graphite2::TtfUtil::CmapSubtable12Lookup] TtfUtil.cpp:1126 (CVE-2016-2801)
- graphite2: heap-buffer-overflow read in [@graphite2::TtfUtil::CmapSubtable4NextCodepoint] (CVE-2016-2802)