Уязвимость чтения и записи за пределами буфера и использование неинициализированной памяти в библиотеке Graphite 2 в Firefox и Thunderbird
Описание
В библиотеке Graphite 2 обнаружен ряд уязвимостей, включая чтение за пределами буфера, переполнение буфера при чтении и записи, а также использование неинициализированной памяти. Эти проблемы были устранены в версии 1.3.10.
Затронутые версии ПО
- Firefox версий до 54
- Firefox ESR версий до 52.2
- Thunderbird версий до 52.2
Тип уязвимости
- Чтение и запись за пределами буфера
- Использование неинициализированной памяти
Ссылки
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryVDB Entry
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Issue TrackingVendor Advisory
- Issue TrackingVendor Advisory
- Issue TrackingVendor Advisory
- Issue TrackingVendor Advisory
- Issue TrackingVendor Advisory
- Issue TrackingVendor Advisory
- Issue TrackingVendor Advisory
- Issue TrackingVendor Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
Одно из
EPSS
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
Связанные уязвимости
A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2 version 1.3.10. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2 version 1.3.10. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
A number of security vulnerabilities in the Graphite 2 library includi ...
A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2 version 1.3.10. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
Уязвимость функции lz4::decompress библиотеки Graphite 2 браузеров Mozilla Firefox и Mozilla Firefox ESR, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
EPSS
9.8 Critical
CVSS3
7.5 High
CVSS2