CVE-2015-6781

High

Published: 06/12/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

Integer overflow in the FontData::Bound function in Google sfntly, used in Google Chrome before version 47.0.2526.73, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted offset or length value within font data in an SFNT container.

Risk Assessment

An attacker could exploit this vulnerability to disrupt application functionality, potentially leading to service downtime and financial losses for the organization.

Recommendation

It is recommended to update Google Chrome to the latest version to mitigate this vulnerability and to monitor systems for unauthorized access attempts.

Other vulnerabilities in Google sfntly, Google Chrome

CVE-2016-1709High
CVE-2016-1709 involves a heap-based buffer overflow in the ByteArray::Get method in Google sfntly before 2016-06-10, which may lead to denial of service or unspecified other impacts via a crafted SFNT font.

Original NVD description (English source)

Integer overflow in the FontData::Bound function in data/font_data.cc in Google sfntly, as used in Google Chrome before 47.0.2526.73, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted offset or length value within font data in an SFNT container.