CVE-2016-1709

High

Published: 23/07/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

CVE-2016-1709 involves a heap-based buffer overflow in the ByteArray::Get method in Google sfntly before 2016-06-10, which may lead to denial of service or unspecified other impacts via a crafted SFNT font.

Risk Assessment

Remote attackers may exploit this vulnerability to disrupt application or system functionality, potentially leading to serious availability issues.

Recommendation

It is recommended to update Google sfntly to a version after 2016-06-10 and review and update Google Chrome to version 52.0.2743.82 or later.

Other vulnerabilities in Google sfntly, Google Chrome

CVE-2015-6781High
Integer overflow in the FontData::Bound function in Google sfntly, used in Google Chrome before version 47.0.2526.73, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted offset or length value within font data in an SFNT container.

Original NVD description (English source)

Heap-based buffer overflow in the ByteArray::Get method in data/byte_array.cc in Google sfntly before 2016-06-10, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SFNT font.