{"id":"CVE-2016-1526","aliases":["DEBIAN-CVE-2016-1526","DSA-3477-1","DSA-3479-1","DSA-3491-1","EUVD-2016-2621","GHSA-44hj-fxxj-472x","MGASA-2016-0077","MGASA-2016-0078","RHSA-2016:0594","RHSA-2016:0695","SUSE-SU-2016:0779-1","UBUNTU-CVE-2016-1526","USN-2902-1"],"status":"published","title":"The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in...","description":"The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02254,"percentile":0.83054,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-200"],"published":"2016-02-08T00:00:00Z","modified":"2026-10-24T10:30:23Z","fixes":[{"ecosystem":"Debian:12","package":"graphite2","fixed_in":["1.3.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"graphite2","fixed_in":["1.3.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"graphite2","fixed_in":["1.3.5-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"graphite2","fixed_in":["1.2.4-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"graphite2","fixed_in":["1.3.5-1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"iceweasel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1esr-1~deb7u1"}]}],"versions":["10.0.12esr-1","10.0.12esr-1+alpha","10.0.12esr-1+nmu1","10.0.12esr-1+nmu1+alpha","11.0-1","11.0-2","11.0-3","11.0-4","11.0~b1-1","11.0~b1-2","11.0~b2-1","11.0~b3-1","11.0~b4-1","11.0~b5-1","11.0~b6-1","12.0-1","12.0-2","12.0-3","12.0-4","12.0-5","12.0-6","12.0-7","13.0-1","13.0.1-1","13.0.1-2","14.0.1-1","14.0.1-2","15.0-1","15.0.1-1","16.0-1","16.0.1-1","16.0.2-1","17.0-1","17.0.1-1","17.0.1-2","17.0.10esr-1~deb7u1","17.0.5esr-1","17.0.6esr-1","17.0.6esr-1~deb7u1","17.0.7esr-1","17.0.7esr-1~deb7u1","17.0.7esr-2","17.0.8esr-1","17.0.8esr-1~deb7u1","17.0.8esr-2","17.0.8esr-2~deb7u1","17.0.9esr-1~deb7u1","18.0-1","18.0.1-1","18.0.2-1","19.0-1","19.0.2-1","20.0-1","21.0-1","22.0-1","23.0-1","23.0-2","23.0.1-1","24.0-1","24.0-2","24.0~b4-1","24.0~b7-1","24.0~b9-1","24.1.0esr-1","24.1.0esr-1+powerpcspe1","24.2.0esr-1","24.2.0esr-1+alpha","24.2.0esr-1+powerpcspe1","24.3.0esr-1","24.3.0esr-1+alpha","24.3.0esr-1~deb7u1","24.4.0esr-1","24.4.0esr-1~deb7u2","24.5.0esr-1","24.5.0esr-1~deb7u1","24.6.0esr-1~deb7u1","24.7.0esr-1~deb7u1","24.8.0esr-1~deb7u1","24.8.1esr-1~deb7u1","25.0-1","25.0~b3-1","25.0~b9-1","26.0-1","27.0-1","27.0-2","27.0.1-1","28.0-1","29.0-1","29.0-2","29.0.1-1","29.0.1-1+alpha","29.0.1-2","30.0-1","30.0-2","30.0~b3-1","30.0~b5-1","30.0~b5-2","30.0~b5-3","30.0~b7-1","31.0-1","31.0-2","31.0-3","31.0~b1-1","31.0~b3-1","31.1.0esr-1","31.2.0esr-1","31.2.0esr-1~deb7u1","31.2.0esr-2","31.2.0esr-2+hurd.0","31.2.0esr-2~deb7u1","31.2.0esr-3","31.2.0esr-3~deb7u1","31.3.0esr-1","31.3.0esr-1+powerpcspe1","31.3.0esr-1~deb7u1","31.4.0esr-1","31.4.0esr-1~deb7u1","31.5.0esr-1","31.5.0esr-1~deb7u1","31.5.3esr-1","31.5.3esr-1~deb7u1","31.6.0esr-1","31.6.0esr-1~deb7u1","31.7.0esr-1~deb7u1","31.7.0esr-1~deb8u1","31.8.0esr-1~deb7u1","31.8.0esr-1~deb8u1","32.0-1","32.0.3-1","32.0~b1-1","32.0~b3-1","32.0~b5-1","33.0-1","33.0-2","33.1-1","34.0-1","35.0-1","35.0.1-1","36.0-1","36.0-2","36.0.1-1","36.0.1-2","36.0.4-1","37.0-1","37.0.1-1","37.0.2-1","38.0-1","38.0-2","38.0.1-1","38.0.1-2","38.0.1-3","38.0.1-4","38.0.1-5","38.1.0esr-1","38.1.0esr-2","38.1.0esr-3","38.1.1esr-1","38.1.1esr-1~deb9u1","38.2.0esr-1","38.2.0esr-1~deb7u1","38.2.0esr-1~deb8u1","38.2.0esr-1~stretch","38.2.1esr-1","38.2.1esr-1~deb7u1","38.2.1esr-1~deb8u1","38.3.0esr-1","38.3.0esr-1~deb7u1","38.3.0esr-1~deb8u1","38.4.0esr-1","38.4.0esr-1~deb7u1","38.4.0esr-1~deb8u1","38.5.0esr-1","38.5.0esr-1~deb7u2","38.5.0esr-1~deb8u1","38.5.0esr-1~deb8u2","38.6.0esr-1~deb7u1","38.6.0esr-1~deb8u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:8","package":"iceweasel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1esr-1~deb8u1"}]}],"versions":["31.6.0esr-1","31.7.0esr-1~deb7u1","31.7.0esr-1~deb8u1","31.8.0esr-1~deb7u1","31.8.0esr-1~deb8u1","32.0-1","32.0.3-1","32.0~b1-1","32.0~b3-1","32.0~b5-1","33.0-1","33.0-2","33.1-1","34.0-1","35.0-1","35.0.1-1","36.0-1","36.0-2","36.0.1-1","36.0.1-2","36.0.4-1","37.0-1","37.0.1-1","37.0.2-1","38.0-1","38.0-2","38.0.1-1","38.0.1-2","38.0.1-3","38.0.1-4","38.0.1-5","38.1.0esr-1","38.1.0esr-2","38.1.0esr-3","38.1.1esr-1","38.1.1esr-1~deb9u1","38.2.0esr-1","38.2.0esr-1~deb7u1","38.2.0esr-1~deb8u1","38.2.0esr-1~stretch","38.2.1esr-1","38.2.1esr-1~deb7u1","38.2.1esr-1~deb8u1","38.3.0esr-1","38.3.0esr-1~deb7u1","38.3.0esr-1~deb8u1","38.4.0esr-1","38.4.0esr-1~deb7u1","38.4.0esr-1~deb8u1","38.5.0esr-1","38.5.0esr-1~deb7u2","38.5.0esr-1~deb8u1","38.5.0esr-1~deb8u2","38.6.0esr-1~deb7u1","38.6.0esr-1~deb8u1","38.6.1esr-1~deb7u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:7","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1~deb7u1"}]}],"versions":["1.1.3-1","1.1.3-1+powerpcspe1","1.2.0-1","1.2.0-2","1.2.0-3","1.2.0-4","1.2.1-1","1.2.1-2","1.2.1-2+powerpcspe1","1.2.2-1","1.2.2-1+alpha","1.2.2-2","1.2.3-1","1.2.3-1+powerpcspe1","1.2.4-1","1.2.4-1+powerpcspe1","1.2.4-2","1.2.4-3","1.3.0-1","1.3.0-2","1.3.2-1","1.3.2-2","1.3.2-3","1.3.2-4","1.3.3-1","1.3.4-1","1.3.4-2"],"bundled":4},{"source":"osv","ecosystem":"Debian:8","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1~deb8u1"}]}],"versions":["1.2.4-3","1.3.0-1","1.3.0-2","1.3.2-1","1.3.2-2","1.3.2-3","1.3.2-4","1.3.3-1","1.3.4-1","1.3.4-2","1.3.5-1~deb7u1"],"bundled":4},{"source":"osv","ecosystem":"Debian:7","package":"icedove","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.0-1~deb7u1"}]}],"versions":["10.0.12-1","11.0-1","16.0.2-1","17.0-1","17.0.10-1","17.0.10-1+powerpcspe1","17.0.10-1+powerpcspe2","17.0.10-1~deb7u1","17.0.2-1","17.0.4-1","17.0.5-1","17.0.5-2","17.0.7-1","17.0.7-1~deb7u1","17.0.8-1","17.0.8-1~deb7u1","17.0.9-1","17.0.9-1~deb7u1","17.0.9-2","24.0-1","24.0~b3-2","24.1.1-1","24.2.0-1","24.2.0-1+alpha","24.2.0-1+powerpcspe1","24.3.0-1","24.3.0-2","24.4.0-1","24.4.0-1~deb7u1","24.5.0-1","24.5.0-1~deb7u1","24.5.0-2","24.6.0-1~deb7u1","24.7.0-1~deb7u1","24.8.0-1~deb7u1","24.8.1-1~deb7u1","30.0~b1-1","31.0-1","31.0-2","31.0-3","31.0~b1-2","31.0~b2-1","31.1.2-1","31.2.0-1","31.2.0-1~deb7u1","31.3.0-1","31.3.0-1+powerpcspe1","31.3.0-1~deb7u1","31.4.0-1","31.4.0-1~deb7u1","31.4.0-2","31.5.0-1","31.5.0-1~deb7u1","31.6.0-1","31.6.0-1~deb7u1","31.7.0-1","31.7.0-1~deb7u1","31.7.0-1~deb8u1","31.8.0-1~deb7u1","31.8.0-1~deb8u1","31.8.0-1~deb8u1+kbsd11","32.0~b1-1","33.0~b1-1","34.0~b1-1","34.0~b1-2","36.0~b1-1","36.0~b1-2","38.0.1-1","38.0~b2-1","38.0~b5-1","38.1.0-1","38.2.0-1","38.2.0-1~stretch","38.2.0-2","38.3.0-1","38.3.0-1~deb7u1","38.3.0-1~deb8u1","38.3.0-2","38.4.0-1","38.4.0-1~deb7u1","38.4.0-1~deb8u1","38.5.0-1","38.5.0-1~deb7u1","38.5.0-1~deb8u1"],"bundled":5},{"source":"osv","ecosystem":"Debian:8","package":"icedove","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.0-1~deb8u1"}]}],"versions":["31.6.0-1","31.7.0-1","31.7.0-1~deb7u1","31.7.0-1~deb8u1","31.8.0-1~deb7u1","31.8.0-1~deb8u1","31.8.0-1~deb8u1+kbsd11","32.0~b1-1","33.0~b1-1","34.0~b1-1","34.0~b1-2","36.0~b1-1","36.0~b1-2","38.0.1-1","38.0~b2-1","38.0~b5-1","38.1.0-1","38.2.0-1","38.2.0-1~stretch","38.2.0-2","38.3.0-1","38.3.0-1~deb7u1","38.3.0-1~deb8u1","38.3.0-2","38.4.0-1","38.4.0-1~deb7u1","38.4.0-1~deb8u1","38.5.0-1","38.5.0-1~deb7u1","38.5.0-1~deb8u1","38.6.0-1~deb7u1"],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1-1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"firefox-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.1-1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.0-1.mga5"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:5","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.6.0-1.mga5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"graphite2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"graphite2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"graphite2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"graphite2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"graphite2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"graphite2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"graphite2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"graphite2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.6-1.el7_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:45.1.0-1.el5_11"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:45.1.0-1.el5_11"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:45.1.0-1.el5_11"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:45.1.0-1.el5_11"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:45.1.0-1.el6_7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:45.1.0-1.el6_7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:45.1.0-1.el6_7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:45.1.0-1.el6_7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:45.1.0-1.el6_7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:45.1.0-1.el6_7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:45.1.0-1.el6_7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:45.1.0-1.el6_7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:45.1.0-1.el7_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:45.1.0-1.el7_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:45.1.0-1.el7_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:45.1.0-1.el7_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:45.1.0-1.el7_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:45.1.0-1.el7_2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu1.1"}]}],"versions":["1.2.3-1","1.2.4-1","1.2.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1ubuntu1"}]}],"versions":["1.2.4-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"graphite2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu1.1"}]}],"versions":["1.2.3-1","1.2.4-1","1.2.4-1ubuntu1"],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"mozilla","product":"firefox"},{"vendor":"mozilla","product":"thunderbird"},{"vendor":"sil","product":"graphite2"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00088.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201701-35","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/82991","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2902-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0695.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0594.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00058.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.debian.org/security/2016/dsa-3479","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177520.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00052.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201701-63","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184623.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.mozilla.org/security/announce/2016/mfsa2016-14.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1526","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-44hj-fxxj-472x"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-1526","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0077.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17780","tags":["report"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0057/","tags":["web","article"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0058/","tags":["web","article"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0059/","tags":["web","article"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0060/","tags":["web","article"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0061/","tags":["web","article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2016-14/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/","tags":["web"]},{"url":"https://www.debian.org/security/2016/dsa-3477","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2016-0078.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17781","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2016-01/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2016-03/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2016-0071.html","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2016-0197.html","tags":["web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-02/msg00105.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0594","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://raw.githubusercontent.com/silnrsi/graphite/master/ChangeLog","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1305805","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1305810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1305813","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1308590","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0594.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1521","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1521","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1521","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1522","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1522","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1522","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1523","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1523","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1523","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1526","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1526","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0695","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/#firefoxesr45.1","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1330266","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1330270","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1330271","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1330280","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1330286","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0695.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2805","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2805","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2805","tags":["advisory"]},{"url":"https://www.mozilla.org/security/announce/2016/mfsa2016-39.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2806","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2806","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2806","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2807","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2807","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2807","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2808","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2808","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2808","tags":["advisory"]},{"url":"https://www.mozilla.org/security/announce/2016/mfsa2016-47.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2814","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2814","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2814","tags":["advisory"]},{"url":"https://www.mozilla.org/security/announce/2016/mfsa2016-44.html","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160779-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/965803","tags":["report"]},{"url":"https://bugzilla.suse.com/965807","tags":["report"]},{"url":"https://bugzilla.suse.com/965810","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1526","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-1526","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2902-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-1521","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1522","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1523","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-1526","description":"The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.","status":"published","published":"2016-02-13T02:00:00Z","modified":"2024-08-05T23:02:11.867Z","updated_at":"2026-11-02T14:33:35.488991Z"}],"euvd":[{"id":"EUVD-2016-2621","description":"The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.","status":"published","published":"2016-02-13T02:00:00Z","modified":"2024-08-05T23:02:11Z","updated_at":"2026-11-03T02:22:56.986033Z"}],"ghsa":[{"id":"GHSA-44hj-fxxj-472x","title":"The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in...","description":"The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.","status":"published","published":"2022-05-14T03:57:55Z","modified":"2023-02-03T05:00:54Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:52:52.51715Z"}],"nvd":[{"id":"CVE-2016-1526","description":"The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.","status":"published","published":"2016-02-13T02:59:12.027Z","modified":"2026-06-17T00:42:07.517Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119","CWE-200"],"updated_at":"2026-11-02T14:03:22.479119Z"}],"osv":[{"id":"CVE-2016-1526","description":"The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.","status":"published","published":"2016-02-13T02:59:12.027Z","modified":"2026-10-24T10:30:23.136200078Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-1526","description":"The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.","status":"published","published":"2016-02-13T02:59:12.027Z","modified":"2026-09-22T07:01:25.156299958Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2016-1526","description":"The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.","status":"published","published":"2016-02-08T00:00:00Z","modified":"2026-04-22T10:31:39.254477Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"DSA-3477-1","title":"iceweasel - security update","status":"published","published":"2016-02-14T00:00:00Z","modified":"2026-03-09T01:21:52.265063Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"DSA-3479-1","title":"graphite2 - security update","status":"published","published":"2016-02-15T00:00:00Z","modified":"2026-03-09T01:22:54.486Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"DSA-3491-1","title":"icedove - security update","status":"published","published":"2016-02-24T00:00:00Z","modified":"2026-03-09T01:18:15.519171Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0077","title":"Updated graphite2/firefox packages fix security vulnerability","description":"Multiple vulnerabilities in the graphite2 font library can result in\ninformation disclosure, denial-of-service (application crashes), or code\nexecution via out-of-bounds reads, a NULL pointer dereference, and a\nheap-based buffer overflow (CVE-2016-1521, CVE-2016-1522, CVE-2016-1523,\nCVE-2016-1526).\n\nFirefox includes a bundled copy of the graphite2 library, which has been\nupdated in Firefox ESR 38.6.1.\n","status":"published","published":"2016-02-17T19:06:01Z","modified":"2026-04-16T06:25:09.424629532Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"MGASA-2016-0078","title":"Updated thunderbird packages fix security vulnerability","description":"Several flaws were found in the processing of malformed web content. A web\npage containing malicious content could cause Thunderbird to crash or,\npotentially, execute arbitrary code with the privileges of the user\nrunning Thunderbird (CVE-2016-1930, CVE-2016-1935).\n\nMultiple security flaws were found in the graphite2 font library bundled\nwith Thunderbird. A web page containing malicious content could cause\nThunderbird to crash or, potentially, execute arbitrary code with the\nprivileges of the user running Thunderbird (CVE-2016-1521, CVE-2016-1522,\nCVE-2016-1523, CVE-2016-1526).\n\nThunderbird includes a bundled copy of the graphite2 library, which has\nbeen updated in Thunderbird 38.6.0.\n","status":"published","published":"2016-02-17T19:06:01Z","modified":"2026-04-16T06:23:43.83623934Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"RHSA-2016:0594","title":"Red Hat Security Advisory: graphite2 security, bug fix, and enhancement update","status":"published","published":"2024-09-15T23:12:21Z","modified":"2026-06-27T10:04:19Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0695","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-15T23:12:16Z","modified":"2026-06-26T10:30:31Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"SUSE-SU-2016:0779-1","title":"Security update for graphite2","description":"\nThis update for graphite2 fixes the following issues:\n\n- CVE-2016-1521: The directrun function in directmachine.cpp in\n  Libgraphite did not validate a certain skip operation, which allowed\n  remote attackers to execute arbitrary code, obtain sensitive information,\n  or cause a denial of service (out-of-bounds read and application crash)\n  via a crafted Graphite smart font.\n\n- CVE-2016-1523: The SillMap::readFace function in FeatureMap.cpp in\n  Libgraphite mishandled a return value, which allowed remote attackers\n  to cause a denial of service (missing initialization, NULL pointer\n  dereference, and application crash) via a crafted Graphite smart font.\n\n- CVE-2016-1526: The TtfUtil:LocaLookup function in TtfUtil.cpp in\n  Libgraphite incorrectly validated a size value, which allowed remote\n  attackers to obtain sensitive information or cause a denial of service\n  (out-of-bounds read and application crash) via a crafted Graphite\n  smart font.\n","status":"published","published":"2016-03-15T17:01:26Z","modified":"2026-02-04T04:29:46.099165Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"USN-2902-1","title":"graphite2 vulnerabilities","description":"Yves Younan discovered that graphite2 incorrectly handled certain malformed\nfonts. If a user or automated system were tricked into opening a specially-\ncrafted font file, a remote attacker could use this issue to cause\ngraphite2 to crash, resulting in a denial of service, or possibly execute\narbitrary code.\n","status":"published","published":"2016-02-17T14:46:52Z","modified":"2026-04-22T09:21:32.639188Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}