CVE-2016-1526 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Mozilla Thunderbird

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-200 — Sensitive Information ExposureCWE-125 — Out-of-bounds Read9 documents8 sources
Severity
8.1HIGHNVD
EPSS
0.8%
top 26.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
SIL Graphite2Mozilla ThunderbirdDebian Linux+2 more
Timeline
PublishedFeb 13
Latest updateMay 14

Description

The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:HExploitability: 2.8 | Impact: 5.2

Affected Packages4 packages

▶NVDmozilla/firefox13 versions+12
▶Debiansil/graphite2< 1.3.5-1+3
▶NVDsil/graphite21.2.4

Also affects: Debian Linux 7.0, 8.0, Fedora 22, 23

🔴Vulnerability Details

3
GHSA
GHSA-44hj-fxxj-472x: The TtfUtil:LocaLookup function in TtfUtil↗2022-05-14
▶
CVEList
CVE-2016-1526: The TtfUtil:LocaLookup function in TtfUtil↗2016-02-13
▶
OSV
CVE-2016-1526: The TtfUtil:LocaLookup function in TtfUtil↗2016-02-13
▶

📋Vendor Advisories

3
Ubuntu
graphite2 vulnerabilities↗2016-02-17
▶
Red Hat
graphite2: Out-of-bounds read vulnerability in TfUtil:LocaLookup↗2016-02-05
▶
Debian
CVE-2016-1526: graphite2 - The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2....↗2016
▶

💬Community

2
Bugzilla
CVE-2016-1526 graphite2: Out-of-bounds read vulnerability in TfUtil:LocaLookup↗2016-02-15
▶
Bugzilla
CVE-2016-1526 graphite2: Out-of-bounds read vulnerability in TfUtil:LocaLookup [fedora-all]↗2016-02-15
▶
CVE-2016-1526 — Mozilla Thunderbird vulnerability | cvebase