NVD Vulnerability Detail

CVE-2016-2052

Summary	Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service or possibly have other impact via crafted data, as demonstrated by a buffer over-read resulting from an inverted length check in hb-ot-font.cc, a different issue than CVE-2015-8947.
Publication Date	Jan. 25, 2016, 8:59 p.m.
Registration Date	Jan. 26, 2021, 2:08 p.m.
Last Update	Nov. 21, 2024, 11:47 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:harfbuzz_project:harfbuzz::::::::			1.0.5

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:google:chrome::::::::			47.0.2526.106

Related information, measures and tools

No	URL	refsource	タグ
1	http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html
2	http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html
3	http://lists.opensuse.org/opensuse-updates/2016-08/msg00070.html
4	http://lists.opensuse.org/opensuse-updates/2016-08/msg00070.html
5	http://rhn.redhat.com/errata/RHSA-2016-0072.html
6	http://rhn.redhat.com/errata/RHSA-2016-0072.html
7	http://www.securityfocus.com/bid/81812
8	http://www.securityfocus.com/bid/81812
9	http://www.securitytracker.com/id/1034801
10	http://www.securitytracker.com/id/1034801
11	http://www.ubuntu.com/usn/USN-2877-1
12	http://www.ubuntu.com/usn/USN-2877-1
13	http://www.ubuntu.com/usn/USN-3067-1
14	http://www.ubuntu.com/usn/USN-3067-1
15	https://code.google.com/p/chromium/issues/detail?id=544270
16	https://code.google.com/p/chromium/issues/detail?id=544270
17	https://code.google.com/p/chromium/issues/detail?id=579625
18	https://code.google.com/p/chromium/issues/detail?id=579625
19	https://github.com/behdad/harfbuzz/commit/63ef0b41dc48d6112d1918c1b1de9de8ea90adb5
20	https://github.com/behdad/harfbuzz/commit/63ef0b41dc48d6112d1918c1b1de9de8ea90adb5
21	https://github.com/behdad/harfbuzz/issues/139#issuecomment-148289957
22	https://github.com/behdad/harfbuzz/issues/139#issuecomment-148289957
23	https://security.gentoo.org/glsa/201701-76
24	https://security.gentoo.org/glsa/201701-76

Common Vulnerabilities List

JVN Vulnerability Information

Google Chrome で使用される HarfBuzz におけるサービス運用妨害 (DoS) の脆弱性

Title	Google Chrome で使用される HarfBuzz におけるサービス運用妨害 (DoS) の脆弱性
Summary	Google Chrome で使用される HarfBuzz には、サービス運用妨害 (DoS) 状態にされるなど、不特定の影響を受ける脆弱性が存在します。
Possible impacts	攻撃者により、サービス運用妨害 (DoS) 状態にされるなど、不特定の影響を受ける可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 20, 2016, midnight
Registration Date	Jan. 27, 2016, 4:28 p.m.
Last Update	Sept. 5, 2016, 6:17 p.m.

Affected System

Google

Google Chrome 48.0.2564.82 未満

HarfBuzz project

HarfBuzz 1.0.6 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-2052	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2052
National Vulnerability Database (NVD)
2	CVE-2016-2052	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2052

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo

ベンダー情報

No	Name	URL
GitHub
1	fuzzing harfbuzz #139	https://github.com/behdad/harfbuzz/issues/139#issuecomment-148289957
2	[ot-font] Fix hmtx wrong table length check	https://github.com/behdad/harfbuzz/commit/63ef0b41dc48d6112d1918c1b1de9de8ea90adb5
Google
3	Google Chrome	https://www.google.com/intl/ja/chrome/browser/features.html
4	Stable Channel Update	http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html
Google Code
5	Issue 544270	https://code.google.com/p/chromium/issues/detail?id=544270
6	Issue 579625	https://code.google.com/p/chromium/issues/detail?id=579625
HarfBuzz
7	Top Page	http://freedesktop.org/wiki/Software/HarfBuzz/

Change Log

No	Changed Details	Date of change
0	[2016年01月27日] 掲載 [2016年09月05日] ベンダ情報：HarfBuzz project (fuzzing harfbuzz #139) を追加ベンダ情報：HarfBuzz project ([ot-font] Fix hmtx wrong table length check) を追加	Feb. 17, 2018, 10:37 a.m.