Graphite2 vulnerabilities | LiveThreat CVE Feed

Product

Graphite2

by Sil · last CVE Apr 15, 2019

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities28 In the news0 Timeline

Severity mix

Critical 2High 25Medium 1Low 0

Severity

All severities28 Critical2 High25 Medium1 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Graphite2 to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2017-7777	8.8	1%	Apr 15	Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function Affected: before 1.3.10
CVE-2017-7773	8.8	1%	Apr 15	Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54 in lz4::decompress src/Decompressor Affected: before 1.3.10
CVE-2017-7772	8.8	1%	Apr 12	Heap-based Buffer Overflow in Graphite2 library in Firefox before 54 in lz4::decompress function Affected: before 1.3.10
CVE-2017-5436	8.8	2%	Jun 11	An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font Affected: before 1.3.10
CVE-2018-7999	8.8	2%	Mar 9	In libgraphite2 in graphite2 1.3.11, a NULL pointer dereference vulnerability was found in Segment.cpp during a dumbRendering operation, which may allow attackers to cause a… Affected: 1.3.11
CVE-2016-2802	8.8	2%	Mar 13	The graphite2::TtfUtil::CmapSubtable4NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote… Affected: through 1.3.5
CVE-2016-2801	8.8	2%	Mar 13	The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows… Affected: through 1.3.5
CVE-2016-2800	8.8	2%	Mar 13	The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to… Affected: through 1.3.5
CVE-2016-2799	8.8	5%	Mar 13	Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows… Affected: through 1.3.5
CVE-2016-2798	8.8	2%	Mar 13	The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to… Affected: through 1.3.5
CVE-2016-2797	8.8	3%	Mar 13	The graphite2::TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers… Affected: through 1.3.5
CVE-2016-2796	8.8	4%	Mar 13	Heap-based buffer overflow in the graphite2::vm::Machine::Code::Code function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7,… Affected: through 1.3.5
CVE-2016-2795	8.8	2%	Mar 13	The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for… Affected: through 1.3.5
CVE-2016-2794	8.8	3%	Mar 13	The graphite2::TtfUtil::CmapSubtable12NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote… Affected: through 1.3.5
CVE-2016-2793	8.8	3%	Mar 13	CachedCmap.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer… Affected: through 1.3.5
CVE-2016-2792	8.8	2%	Mar 13	The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to… Affected: through 1.3.5
CVE-2016-2791	8.8	2%	Mar 13	The graphite2::GlyphCache::glyph function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a… Affected: through 1.3.5
CVE-2016-2790	8.8	2%	Mar 13	The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for… Affected: through 1.3.5
CVE-2016-1977	8.8	3%	Mar 13	The Machine::Code::decoder::analysis::set_ref function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers… Affected: through 1.3.5
CVE-2016-1969	8.8	2%	Mar 13	The setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.6.1, allows remote attackers to cause a denial of service… Affected: through 1.3.5
CVE-2016-1522	8.8	8%	Feb 13	Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check,… Affected: 1.2.4
CVE-2016-1521	8.8	4%	Feb 13	The directrun function in directmachine.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not validate a… Affected: through 1.2.4
CVE-2017-7776	8.1	3%	Apr 15	Heap-based Buffer Overflow read in Graphite2 library in Firefox before 54 in graphite2::Silf::getClassGlyph Affected: before 1.3.10
CVE-2017-7771	8.1	1%	Apr 15	Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Pass::readPass function Affected: before 1.3.10
CVE-2016-1526	8.1	2%	Feb 13	The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates… Affected: 1.2.4