Graphite2 - Multiple Vulnerabilities
Summary
DSA-3479-1: graphite2 - security update. Affects graphite2 versions < 1.3.5-1~deb7u1. Fixed in 1.3.5-1~deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Graphite2 is a font rendering engine that provides support for complex scripts and languages. It is used by various applications to render text and display fonts. However, multiple vulnerabilities have been discovered in Graphite2 that could allow an attacker to execute arbitrary code or cause a denial of service if a malformed font file is processed.
Vulnerability Detail
The vulnerabilities in Graphite2 stem from issues in the font rendering engine's code. If a specially crafted font file is processed by an application that uses Graphite2, it can trigger these vulnerabilities. The consequences of exploitation include potential arbitrary code execution or crashing the application, leading to a denial of service. The vulnerabilities have been assigned the following CVE identifiers: CVE-2016-1521, CVE-2016-1522, CVE-2016-1523, and CVE-2016-1526.
How To Fix
Minimum fixed version
1.3.5-1~deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade graphite2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Multiple vulnerabilities have been discovered in the Graphite2 font rendering engine, which could allow an attacker to execute arbitrary code or cause a denial of service. It is crucial to upgrade to the fixed versions of the graphite2 package to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for graphite2 →
FAQ
Graphite2 is a font rendering engine used by applications to render complex scripts and languages.
If a maliciously crafted font file is processed by an application using Graphite2, it could lead to arbitrary code execution or a denial of service.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for open-source vulnerabilities in real-time.
No specific workarounds have been provided for these vulnerabilities. It is recommended to upgrade to the fixed versions of the graphite2 package.
You can obtain the fixed versions of graphite2 from the official Debian repositories or through the package manager of your distribution.
Related vulnerabilities
Recent vulnerabilities recorded for graphite2.
