Search for packages
Package details: pkg:deb/debian/graphite2@1.3.6-1~deb7u1
purl pkg:deb/debian/graphite2@1.3.6-1~deb7u1
Next non-vulnerable version 1.3.13-7
Latest non-vulnerable version 1.3.13-7
Risk 4.5
Vulnerabilities affecting this package (23)
Vulnerability Summary Fixed by
VCID-1stj-xuxd-ykbt
Aliases:
CVE-2016-2802
Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
VCID-21wp-eycu-kbfu
Aliases:
CVE-2016-1977
Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
VCID-29cd-ee2e-eudd
Aliases:
CVE-2016-2800
Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
VCID-347w-5rsv-tugs
Aliases:
CVE-2017-7773
Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54 in lz4::decompress src/Decompressor.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
1.3.10-1
Affected by 1 other vulnerability.
VCID-3cp3-cxzm-17bt
Aliases:
CVE-2017-7776
Heap-based Buffer Overflow read in Graphite2 library in Firefox before 54 in graphite2::Silf::getClassGlyph.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
1.3.10-1
Affected by 1 other vulnerability.
VCID-3zm4-kw65-5khp
Aliases:
CVE-2016-2791
Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
VCID-4u3g-ucaz-pkfd
Aliases:
CVE-2017-7777
Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
1.3.10-1
Affected by 1 other vulnerability.
VCID-7xvr-jqtj-a3c7
Aliases:
CVE-2016-2799
Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
VCID-ab54-wdtp-33ea
Aliases:
CVE-2016-2792
Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
VCID-bez4-avz6-ske4
Aliases:
CVE-2016-1969
Security researcher James Clawson used the Address Sanitizer tool to discover an out-of-bounds write in the Graphite 2 library when loading a crafted Graphite font file. This results in a potentially exploitable crash.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
VCID-cfr5-npdq-j3fm
Aliases:
CVE-2017-7771
Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Pass::readPass function.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
1.3.10-1
Affected by 1 other vulnerability.
VCID-czwf-6b9h-uucu
Aliases:
CVE-2018-7999
In libgraphite2 in graphite2 1.3.11, a NULL pointer dereference vulnerability was found in Segment.cpp during a dumbRendering operation, which may allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted .ttf file.
1.3.13-7
Affected by 0 other vulnerabilities.
VCID-fbup-v86f-97ex
Aliases:
CVE-2016-2801
Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
VCID-j7dr-d5kk-4kdt
Aliases:
CVE-2016-2798
Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
VCID-jxju-q8ue-r7g7
Aliases:
CVE-2016-2793
Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
VCID-m5ne-1n7g-8ka3
Aliases:
CVE-2017-7772
Heap-based Buffer Overflow in Graphite2 library in Firefox before 54 in lz4::decompress function.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
1.3.10-1
Affected by 1 other vulnerability.
VCID-mbbs-34nc-gyb4
Aliases:
CVE-2017-7778
A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2 version 1.3.10.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
1.3.10-1
Affected by 1 other vulnerability.
VCID-stvs-mzq6-27ef
Aliases:
CVE-2017-7774
Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Silf::readGraphite function.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
1.3.10-1
Affected by 1 other vulnerability.
VCID-u62c-xz51-fbd4
Aliases:
CVE-2016-2790
Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
VCID-u7ae-pca4-j7fp
Aliases:
CVE-2016-2795
Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
VCID-uqhq-r8p1-k7fn
Aliases:
CVE-2016-2797
Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
VCID-wmdm-wzx4-nkhr
Aliases:
CVE-2016-2794
Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
VCID-yrhc-hchg-7kf3
Aliases:
CVE-2016-2796
Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6.
1.3.10-1~deb8u1
Affected by 8 other vulnerabilities.
Vulnerabilities fixed by this package (19)
Vulnerability Summary Aliases
VCID-1b2x-ez7j-73hy CVE-2016-1522
VCID-1stj-xuxd-ykbt Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6. CVE-2016-2802
VCID-21wp-eycu-kbfu Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6. CVE-2016-1977
VCID-29cd-ee2e-eudd Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6. CVE-2016-2800
VCID-3zm4-kw65-5khp Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6. CVE-2016-2791
VCID-7xvr-jqtj-a3c7 Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6. CVE-2016-2799
VCID-ab54-wdtp-33ea Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6. CVE-2016-2792
VCID-bez4-avz6-ske4 Security researcher James Clawson used the Address Sanitizer tool to discover an out-of-bounds write in the Graphite 2 library when loading a crafted Graphite font file. This results in a potentially exploitable crash. CVE-2016-1969
VCID-fbup-v86f-97ex Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6. CVE-2016-2801
VCID-j7dr-d5kk-4kdt Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6. CVE-2016-2798
VCID-jxju-q8ue-r7g7 Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6. CVE-2016-2793
VCID-nj2a-cp1k-w7bg CVE-2016-1521
VCID-tekz-b2u3-8fcs Security researcher Holger Fuhrmannek reported that a malicious Graphite "smart font" could circumvent the validation of internal instruction parameters in the Graphite 2 library using special CNTXT_ITEM instructions. This could result in arbitrary code execution. This issue affected Graphite 2 version 1.3.4, which was used in the Firefox ESR branch. To address this issue and other security vulnerabilities recently disclosed by Cisco Talos affecting this version of the library, Firefox ESR has been updated to version 1.3.5, the same one used in Firefox 44. In general this flaw cannot be exploited through email in the Thunderbird product, but is potentially a risk in browser or browser-like contexts. CVE-2016-1523
VCID-u62c-xz51-fbd4 Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6. CVE-2016-2790
VCID-u7ae-pca4-j7fp Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6. CVE-2016-2795
VCID-uqhq-r8p1-k7fn Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6. CVE-2016-2797
VCID-wmdm-wzx4-nkhr Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6. CVE-2016-2794
VCID-yrhc-hchg-7kf3 Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. To address these security vulnerabilities, Firefox 45 and Firefox ESR 38.7 have been updated to Graphite 2 version 1.3.6. CVE-2016-2796
VCID-yt4r-4gez-gfgc CVE-2016-1526

Date Actor Action Vulnerability Source VulnerableCode Version
2025-08-01T19:56:46.633369+00:00 Debian Oval Importer Affected by VCID-u62c-xz51-fbd4 https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T19:52:39.423768+00:00 Debian Oval Importer Fixing VCID-yt4r-4gez-gfgc https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T19:52:17.316203+00:00 Debian Oval Importer Affected by VCID-jxju-q8ue-r7g7 https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T19:45:57.604126+00:00 Debian Oval Importer Affected by VCID-u7ae-pca4-j7fp https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T19:38:35.368290+00:00 Debian Oval Importer Affected by VCID-czwf-6b9h-uucu https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T19:31:22.581024+00:00 Debian Oval Importer Affected by VCID-3cp3-cxzm-17bt https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T19:26:29.917250+00:00 Debian Oval Importer Affected by VCID-mbbs-34nc-gyb4 https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T19:18:18.466972+00:00 Debian Oval Importer Affected by VCID-1stj-xuxd-ykbt https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T18:56:08.778418+00:00 Debian Oval Importer Affected by VCID-3zm4-kw65-5khp https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T18:24:45.259310+00:00 Debian Oval Importer Affected by VCID-m5ne-1n7g-8ka3 https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T18:24:15.177272+00:00 Debian Oval Importer Affected by VCID-wmdm-wzx4-nkhr https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T17:17:01.579971+00:00 Debian Oval Importer Affected by VCID-cfr5-npdq-j3fm https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T16:58:29.628561+00:00 Debian Oval Importer Affected by VCID-4u3g-ucaz-pkfd https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T16:54:42.603651+00:00 Debian Oval Importer Affected by VCID-347w-5rsv-tugs https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T16:39:01.074141+00:00 Debian Oval Importer Affected by VCID-stvs-mzq6-27ef https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T16:34:16.740399+00:00 Debian Oval Importer Fixing VCID-nj2a-cp1k-w7bg https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T16:13:43.919106+00:00 Debian Oval Importer Affected by VCID-ab54-wdtp-33ea https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T16:12:37.413835+00:00 Debian Oval Importer Affected by VCID-fbup-v86f-97ex https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T15:36:02.724258+00:00 Debian Oval Importer Affected by VCID-21wp-eycu-kbfu https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T15:00:22.601147+00:00 Debian Oval Importer Affected by VCID-7xvr-jqtj-a3c7 https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T14:29:26.805251+00:00 Debian Oval Importer Affected by VCID-uqhq-r8p1-k7fn https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T14:24:47.920706+00:00 Debian Oval Importer Affected by VCID-bez4-avz6-ske4 https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T13:52:28.857852+00:00 Debian Oval Importer Fixing VCID-tekz-b2u3-8fcs https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T13:49:31.787919+00:00 Debian Oval Importer Affected by VCID-yrhc-hchg-7kf3 https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T13:29:02.334296+00:00 Debian Oval Importer Affected by VCID-j7dr-d5kk-4kdt https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T13:18:00.194813+00:00 Debian Oval Importer Affected by VCID-29cd-ee2e-eudd https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T12:42:56.250685+00:00 Debian Oval Importer Fixing VCID-1b2x-ez7j-73hy https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 37.0.0
2025-08-01T10:25:16.865323+00:00 Debian Oval Importer Affected by VCID-347w-5rsv-tugs https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T10:24:38.112413+00:00 Debian Oval Importer Fixing VCID-nj2a-cp1k-w7bg https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T10:24:29.197191+00:00 Debian Oval Importer Affected by VCID-fbup-v86f-97ex https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T10:23:21.603337+00:00 Debian Oval Importer Affected by VCID-yrhc-hchg-7kf3 https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T10:22:39.879297+00:00 Debian Oval Importer Affected by VCID-u7ae-pca4-j7fp https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T10:22:16.367899+00:00 Debian Oval Importer Affected by VCID-7xvr-jqtj-a3c7 https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T10:19:22.493683+00:00 Debian Oval Importer Affected by VCID-1stj-xuxd-ykbt https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T10:18:38.244350+00:00 Debian Oval Importer Affected by VCID-jxju-q8ue-r7g7 https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T10:14:35.781786+00:00 Debian Oval Importer Affected by VCID-29cd-ee2e-eudd https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T10:14:02.562894+00:00 Debian Oval Importer Affected by VCID-cfr5-npdq-j3fm https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T10:13:31.504757+00:00 Debian Oval Importer Fixing VCID-tekz-b2u3-8fcs https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T10:11:49.089139+00:00 Debian Oval Importer Affected by VCID-wmdm-wzx4-nkhr https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T10:09:49.164868+00:00 Debian Oval Importer Affected by VCID-bez4-avz6-ske4 https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T10:08:34.048786+00:00 Debian Oval Importer Affected by VCID-u62c-xz51-fbd4 https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T10:05:53.389672+00:00 Debian Oval Importer Affected by VCID-ab54-wdtp-33ea https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T10:04:56.733447+00:00 Debian Oval Importer Affected by VCID-4u3g-ucaz-pkfd https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T10:03:03.216398+00:00 Debian Oval Importer Affected by VCID-j7dr-d5kk-4kdt https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T10:02:26.334389+00:00 Debian Oval Importer Affected by VCID-21wp-eycu-kbfu https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T10:02:07.423806+00:00 Debian Oval Importer Affected by VCID-stvs-mzq6-27ef https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T10:00:34.187508+00:00 Debian Oval Importer Affected by VCID-3cp3-cxzm-17bt https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T09:59:52.255947+00:00 Debian Oval Importer Fixing VCID-yt4r-4gez-gfgc https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T09:55:36.227570+00:00 Debian Oval Importer Affected by VCID-3zm4-kw65-5khp https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T09:55:34.048179+00:00 Debian Oval Importer Fixing VCID-1b2x-ez7j-73hy https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T09:54:29.453406+00:00 Debian Oval Importer Affected by VCID-m5ne-1n7g-8ka3 https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T09:52:10.973896+00:00 Debian Oval Importer Affected by VCID-mbbs-34nc-gyb4 https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T09:50:28.020193+00:00 Debian Oval Importer Affected by VCID-uqhq-r8p1-k7fn https://www.debian.org/security/oval/oval-definitions-jessie.xml.bz2 37.0.0
2025-08-01T09:49:54.493539+00:00 Debian Oval Importer Fixing VCID-j7dr-d5kk-4kdt https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2 37.0.0
2025-08-01T09:48:20.249402+00:00 Debian Oval Importer Fixing VCID-uqhq-r8p1-k7fn https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2 37.0.0
2025-08-01T09:47:09.555512+00:00 Debian Oval Importer Fixing VCID-7xvr-jqtj-a3c7 https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2 37.0.0
2025-08-01T09:42:19.891294+00:00 Debian Oval Importer Fixing VCID-u62c-xz51-fbd4 https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2 37.0.0
2025-08-01T09:41:18.074813+00:00 Debian Oval Importer Fixing VCID-bez4-avz6-ske4 https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2 37.0.0
2025-08-01T09:41:02.991522+00:00 Debian Oval Importer Fixing VCID-1b2x-ez7j-73hy https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2 37.0.0
2025-08-01T09:40:45.104083+00:00 Debian Oval Importer Fixing VCID-ab54-wdtp-33ea https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2 37.0.0
2025-08-01T09:39:13.025921+00:00 Debian Oval Importer Fixing VCID-tekz-b2u3-8fcs https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2 37.0.0
2025-08-01T09:39:03.844304+00:00 Debian Oval Importer Fixing VCID-21wp-eycu-kbfu https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2 37.0.0
2025-08-01T09:38:48.953126+00:00 Debian Oval Importer Fixing VCID-yrhc-hchg-7kf3 https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2 37.0.0
2025-08-01T09:33:25.809603+00:00 Debian Oval Importer Fixing VCID-u7ae-pca4-j7fp https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2 37.0.0
2025-08-01T09:31:56.205512+00:00 Debian Oval Importer Fixing VCID-yt4r-4gez-gfgc https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2 37.0.0
2025-08-01T09:30:44.163139+00:00 Debian Oval Importer Fixing VCID-29cd-ee2e-eudd https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2 37.0.0
2025-08-01T09:29:23.403495+00:00 Debian Oval Importer Fixing VCID-nj2a-cp1k-w7bg https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2 37.0.0
2025-08-01T09:28:45.811230+00:00 Debian Oval Importer Fixing VCID-wmdm-wzx4-nkhr https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2 37.0.0
2025-08-01T09:26:44.668808+00:00 Debian Oval Importer Fixing VCID-1stj-xuxd-ykbt https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2 37.0.0
2025-08-01T09:25:20.541572+00:00 Debian Oval Importer Fixing VCID-fbup-v86f-97ex https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2 37.0.0
2025-08-01T09:20:39.260774+00:00 Debian Oval Importer Fixing VCID-3zm4-kw65-5khp https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2 37.0.0
2025-08-01T09:19:49.474946+00:00 Debian Oval Importer Fixing VCID-jxju-q8ue-r7g7 https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2 37.0.0