NetSight
IP …
high8.8

CVE-2016-1521

The directrun function in directmachine.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does…

Impact

The directrun function in directmachine.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not validate a certain skip operation, which allows remote attackers to execute arbitrary code, obtain sensitive information, or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.

Affected products

VendorProductAffected versions
DebianDebian Linux
Versions 7.0, 8.0
SilGraphite2
through 1.2.4
MozillaFirefox
through 42.0
Versions 38.0.1, 38.0.5, 38.1.0, 38.1.1, 38.2.0
MozillaThunderbird
through 38.5.1
FedoraprojectFedora
Versions 22, 23

Weakness classification

CWE-119

References