CVE Feed

    Dashboard / CVE / CVE-2018-7999

    CVE-2018-7999

    In libgraphite2 in graphite2 1.3.11, a NULL pointer dereference vulnerability was found in Segment.cpp during a dumbRendering operation, which may allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted .ttf file.

    Published:Mar 5, 2018
    Last Modified:Nov 21, 2024
    EPS:Mar 9, 2018
    EPSS Score:0.00189
    CVSS Score:8.8

    Affected Products

    Vendor
    Sil
    Product
    Graphite2

    Exploits

    https://github.com/silnrsi/graphite/issues/22https://github.com/silnrsi/graphite/issues/22

    Common Weakness Enumeration

    CWE-476 NULL Pointer Dereference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2017-7777 (CVSS 8.8) — Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_g…
    CVE-2017-7774 (CVSS 9.1) — Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Silf::readGraphite function.…
    CVE-2017-7771 (CVSS 8.1) — Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Pass::readPass function.…
    CVE-2017-7776 (CVSS 8.1) — Heap-based Buffer Overflow read in Graphite2 library in Firefox before 54 in graphite2::Silf::getClassGlyph.…
    CVE-2017-7778 (CVSS 9.8) — A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow …
    CVE-2017-7773 (CVSS 8.8) — Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54 in lz4::decompress src/Decompressor…
    CVE-2017-7772 (CVSS 8.8) — Heap-based Buffer Overflow in Graphite2 library in Firefox before 54 in lz4::decompress function.…
    CVE-2017-5436 (CVSS 8.8) — An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This resu…
    CVE-2016-2792 (CVSS 8.8) — The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox befor…
    CVE-2016-2791 (CVSS 8.8) — The graphite2::GlyphCache::glyph function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 a…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High