CVSS: 8.8EPSS: 1%CPEs: 33EXPL: 0CVE-2016-1950 – nss: Heap buffer overflow vulnerability in ASN1 certificate parsing (MFSA 2016-35)
https://notcve.org/view.php?id=CVE-2016-1950
Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate. El desbordamiento de buffer basado en memoria dinámica en Mozilla Network Security Services (NSS) en versiones anteriores a 3.19.2.3 y 3.20.x y 3.21.x en versiones anteriores a 3.21.1, tal y como se utiliza en Mozilla Firefox en versiones anteriores a 45.0 y Firefox ESR 38.x en versiones anteriores a 38.7, permiten a atacantes remotos ejecutar código arbitrario a través de datos ASN.1 manipulados en un certificado X.509." A heap-based buffer overflow flaw was found in the way NSS parsed certain ASN.1 structures. An attacker could use this flaw to create a specially crafted certificate which, when parsed by NSS, could cause it to crash, or execute arbitrary code, using the permissions of the user running an application compiled against the NSS library. • http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html http://lists.opensuse.org/opensuse-security-announce/2016-03 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.1EPSS: 3%CPEs: 19EXPL: 0CVE-2016-1526 – graphite2: Out-of-bounds read vulnerability in TfUtil:LocaLookup
https://notcve.org/view.php?id=CVE-2016-1526
The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font. La función TtfUtil:LocaLookup en TtfUtil.cpp en Libgraphite en Graphite 2 1.2.4, como se utiliza en Mozilla Firefox en versiones anteriores a 43.0 y Firefox ESR 38.x en versiones anteriores a 38.6.1, valida incorrectamente un valor de tamaño, lo que permite a atacantes remotos obtener información sensible o causar una denegación de servicio (lectura fuera de rango y caída de aplicación) a través de una fuente inteligente Graphite. A vulnerability has been discovered in Graphite2. An attacker able to trick an unsuspecting user into opening specially crafted font files in an application using Graphite2 could exploit these flaws to cause the application to crash or, potentially, execute arbitrary code with the privileges of the application. • http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177520.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184623.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00052.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00058.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00088.html http://rhn.redhat.com/errata/RHSA-2016-0594.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 2%CPEs: 19EXPL: 1CVE-2016-1522 – graphite2: Null pointer dereference and out-of-bounds access vulnerabilities
https://notcve.org/view.php?id=CVE-2016-1522
Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font. Code.cpp en Libgraphite en Graphite 2 1.2.4, como se utiliza en Mozilla Firefox en versiones anteriores a 43.0 y Firefox ESR 38.x en versiones anteriores a 38.6.1, no considera las llamadas recursivas de carga durante una comprobación de tamaño, lo que permite a atacantes remotos causar una denegación de servicio (desbordamiento d buffer basado en memoria dinámica) o posiblemente ejecutar código arbitrario a través de una fuente inteligente Graphite. A vulnerability has been discovered in Graphite2. An attacker able to trick an unsuspecting user into opening specially crafted font files in an application using Graphite2 could exploit these flaws to cause the application to crash or, potentially, execute arbitrary code with the privileges of the application. • http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177520.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184623.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00058.html http://rhn.redhat.com/errata/RHSA-2016-0197.html http://rhn.redhat.com/errata/RHSA-2016-0258.html http://rhn.redhat.com/errata/RHSA-2016-0594.html http://www.debian.org/security/2016&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-476: NULL Pointer Dereference •
CVSS: 6.8EPSS: 2%CPEs: 19EXPL: 0CVE-2016-1523 – graphite2: Heap-based buffer overflow in context item handling functionality
https://notcve.org/view.php?id=CVE-2016-1523
The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font. La función SillMap::readFace en FeatureMap.cpp en Libgraphite en Graphite 2 1.2.4, como se utiliza en Mozilla Firefox en versiones anteriores a 43.0 y Firefox ESR 38.x en versiones anteriores a 38.6.1, no maneja correctamente el valor de retorno, lo que permite a atacantes remotos causar una denegación de servicio (falta inicialización, referencia a puntero NULL y caída de aplicación) a través de una fuente inteligente Graphite. A vulnerability has been discovered in Graphite2. An attacker able to trick an unsuspecting user into opening specially crafted font files in an application using Graphite2 could exploit these flaws to cause the application to crash or, potentially, execute arbitrary code with the privileges of the application. • http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177520.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184623.html http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00053.html http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00055.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00052.html http://lists.opensuse.org/opensuse-security-announce/201 • CWE-122: Heap-based Buffer Overflow •
CVSS: 8.8EPSS: 2%CPEs: 19EXPL: 0CVE-2016-1521 – graphite2: Out-of-bound read vulnerability triggered by crafted fonts
https://notcve.org/view.php?id=CVE-2016-1521
The directrun function in directmachine.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not validate a certain skip operation, which allows remote attackers to execute arbitrary code, obtain sensitive information, or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font. La función directmachine.cpp en Libgraphite en Graphite 2 1.2.4, como se utiliza en Mozilla Firefox en versiones anteriores a 43.0 y Firefox ESR 38.x en versiones anteriores a 38.6.1, no valida una determinada operación de salto, lo que permite a atacantes remotos ejecutar código arbitrario, obtener información sensible o causar una denegación de servicio (lectura fuera de rango y caída de aplicación) a través de una fuente inteligente Graphite. A vulnerability has been discovered in Graphite2. An attacker able to trick an unsuspecting user into opening specially crafted font files in an application using Graphite2 could exploit these flaws to cause the application to crash or, potentially, execute arbitrary code with the privileges of the application. • http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177520.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184623.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00052.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00058.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00088.html http://rhn.redhat.com/errata/RHSA-2016-0197.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •