CVE-2016-1523

The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font.

References

Affected packages

Debian:11 / graphite2

Package

Name: graphite2
Purl: pkg:deb/debian/graphite2?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.5-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / graphite2

Package

Name: graphite2
Purl: pkg:deb/debian/graphite2?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.5-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / graphite2

Package

Name: graphite2
Purl: pkg:deb/debian/graphite2?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.5-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/silnrsi/graphite

Affected ranges

Type: GIT
Repo: https://github.com/silnrsi/graphite
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

6c7f2aa8d4f5d75d3f2ebbb019c4a7e2b0607461

Affected versions

0.*

0.9.3

0.9.4

1.*

1.0.1

1.0.2

1.0.3

1.1.0

1.1.1

1.1.2

1.1.3

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

Release_0.*

Release_0.9

Other

base

r0.*

r0.9.1