In LoadSBitPng of pngshim.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.
{ "vanir_signatures": [ { "digest": { "length": 3189.0, "function_hash": "194011261781284787445973321418735434814" }, "id": "ASB-A-171232105-77115d1a", "source": "https://android.googlesource.com/platform/external/freetype/+/358c238408a1fdc357d9afef6811369a7701e004", "deprecated": false, "signature_version": "v1", "target": { "file": "src/sfnt/pngshim.c", "function": "Load_SBit_Png" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "208860372010935151343063066297222324914", "233030270906213514960881824988592192726", "215268173661816570473557084426646208708", "134347666717980172232860258622704214640", "149472428944486004085391017137533156713", "303862154618928232714109744889947985112", "339779475924866474542854574324866011491", "6017163583475985116083763327437696333", "176004433254996303573680865909396220616", "322771888159213265172234683524941889829", "309209274501869294504350979542704920374", "152300273129484813905548252616649177409" ] }, "id": "ASB-A-171232105-8aae99a6", "source": "https://android.googlesource.com/platform/external/freetype/+/358c238408a1fdc357d9afef6811369a7701e004", "deprecated": false, "signature_version": "v1", "target": { "file": "src/sfnt/pngshim.c" }, "signature_type": "Line" } ], "fixes": [ "https://android.googlesource.com/platform/external/freetype/+/358c238408a1fdc357d9afef6811369a7701e004" ], "spl": "2021-01-01", "severity": "Moderate", "types": [ "RCE" ] }
{ "vanir_signatures": [ { "digest": { "length": 3189.0, "function_hash": "194011261781284787445973321418735434814" }, "id": "ASB-A-171232105-97259488", "source": "https://android.googlesource.com/platform/external/freetype/+/358c238408a1fdc357d9afef6811369a7701e004", "deprecated": false, "signature_version": "v1", "target": { "file": "src/sfnt/pngshim.c", "function": "Load_SBit_Png" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "208860372010935151343063066297222324914", "233030270906213514960881824988592192726", "215268173661816570473557084426646208708", "134347666717980172232860258622704214640", "149472428944486004085391017137533156713", "303862154618928232714109744889947985112", "339779475924866474542854574324866011491", "6017163583475985116083763327437696333", "176004433254996303573680865909396220616", "322771888159213265172234683524941889829", "309209274501869294504350979542704920374", "152300273129484813905548252616649177409" ] }, "id": "ASB-A-171232105-af23209d", "source": "https://android.googlesource.com/platform/external/freetype/+/358c238408a1fdc357d9afef6811369a7701e004", "deprecated": false, "signature_version": "v1", "target": { "file": "src/sfnt/pngshim.c" }, "signature_type": "Line" } ], "fixes": [ "https://android.googlesource.com/platform/external/freetype/+/358c238408a1fdc357d9afef6811369a7701e004" ], "spl": "2021-01-01", "severity": "Moderate", "types": [ "RCE" ] }
{ "vanir_signatures": [ { "digest": { "length": 3189.0, "function_hash": "194011261781284787445973321418735434814" }, "id": "ASB-A-171232105-369de529", "source": "https://android.googlesource.com/platform/external/freetype/+/358c238408a1fdc357d9afef6811369a7701e004", "deprecated": false, "signature_version": "v1", "target": { "file": "src/sfnt/pngshim.c", "function": "Load_SBit_Png" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "208860372010935151343063066297222324914", "233030270906213514960881824988592192726", "215268173661816570473557084426646208708", "134347666717980172232860258622704214640", "149472428944486004085391017137533156713", "303862154618928232714109744889947985112", "339779475924866474542854574324866011491", "6017163583475985116083763327437696333", "176004433254996303573680865909396220616", "322771888159213265172234683524941889829", "309209274501869294504350979542704920374", "152300273129484813905548252616649177409" ] }, "id": "ASB-A-171232105-c2d61352", "source": "https://android.googlesource.com/platform/external/freetype/+/358c238408a1fdc357d9afef6811369a7701e004", "deprecated": false, "signature_version": "v1", "target": { "file": "src/sfnt/pngshim.c" }, "signature_type": "Line" } ], "fixes": [ "https://android.googlesource.com/platform/external/freetype/+/358c238408a1fdc357d9afef6811369a7701e004" ], "spl": "2021-01-01", "severity": "Moderate", "types": [ "RCE" ] }
{ "vanir_signatures": [ { "digest": { "length": 3189.0, "function_hash": "194011261781284787445973321418735434814" }, "id": "ASB-A-171232105-b258d5f8", "source": "https://android.googlesource.com/platform/external/freetype/+/358c238408a1fdc357d9afef6811369a7701e004", "deprecated": false, "signature_version": "v1", "target": { "file": "src/sfnt/pngshim.c", "function": "Load_SBit_Png" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "208860372010935151343063066297222324914", "233030270906213514960881824988592192726", "215268173661816570473557084426646208708", "134347666717980172232860258622704214640", "149472428944486004085391017137533156713", "303862154618928232714109744889947985112", "339779475924866474542854574324866011491", "6017163583475985116083763327437696333", "176004433254996303573680865909396220616", "322771888159213265172234683524941889829", "309209274501869294504350979542704920374", "152300273129484813905548252616649177409" ] }, "id": "ASB-A-171232105-be87eb65", "source": "https://android.googlesource.com/platform/external/freetype/+/358c238408a1fdc357d9afef6811369a7701e004", "deprecated": false, "signature_version": "v1", "target": { "file": "src/sfnt/pngshim.c" }, "signature_type": "Line" } ], "fixes": [ "https://android.googlesource.com/platform/external/freetype/+/358c238408a1fdc357d9afef6811369a7701e004" ], "spl": "2021-01-01", "severity": "Moderate", "types": [ "RCE" ] }
{ "vanir_signatures": [ { "digest": { "length": 3189.0, "function_hash": "194011261781284787445973321418735434814" }, "id": "ASB-A-171232105-633e02ed", "source": "https://android.googlesource.com/platform/external/freetype/+/358c238408a1fdc357d9afef6811369a7701e004", "deprecated": false, "signature_version": "v1", "target": { "file": "src/sfnt/pngshim.c", "function": "Load_SBit_Png" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "208860372010935151343063066297222324914", "233030270906213514960881824988592192726", "215268173661816570473557084426646208708", "134347666717980172232860258622704214640", "149472428944486004085391017137533156713", "303862154618928232714109744889947985112", "339779475924866474542854574324866011491", "6017163583475985116083763327437696333", "176004433254996303573680865909396220616", "322771888159213265172234683524941889829", "309209274501869294504350979542704920374", "152300273129484813905548252616649177409" ] }, "id": "ASB-A-171232105-acff3cac", "source": "https://android.googlesource.com/platform/external/freetype/+/358c238408a1fdc357d9afef6811369a7701e004", "deprecated": false, "signature_version": "v1", "target": { "file": "src/sfnt/pngshim.c" }, "signature_type": "Line" } ], "fixes": [ "https://android.googlesource.com/platform/external/freetype/+/358c238408a1fdc357d9afef6811369a7701e004" ], "spl": "2021-01-01", "severity": "Moderate", "types": [ "RCE" ] }