GNU Emacs for Android is vulnerable to an integer overflow in the sfntreadcmapformat12() function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit builds, causing a heap buffer overflow write. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This results in heap memory corruption that can lead to code execution. This issue was fixed in commit c4e20777c26548722a37b03db93243e83a0d6188
{
"binaries": [
{
"binary_name": "xemacs21",
"binary_version": "21.4.22-14ubuntu1"
},
{
"binary_name": "xemacs21-bin",
"binary_version": "21.4.22-14ubuntu1"
},
{
"binary_name": "xemacs21-mule",
"binary_version": "21.4.22-14ubuntu1"
},
{
"binary_name": "xemacs21-mule-canna-wnn",
"binary_version": "21.4.22-14ubuntu1"
},
{
"binary_name": "xemacs21-nomule",
"binary_version": "21.4.22-14ubuntu1"
},
{
"binary_name": "xemacs21-support",
"binary_version": "21.4.22-14ubuntu1"
},
{
"binary_name": "xemacs21-supportel",
"binary_version": "21.4.22-14ubuntu1"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21-basesupport",
"binary_version": "2009.02.17.dfsg.2-2"
},
{
"binary_name": "xemacs21-basesupport-el",
"binary_version": "2009.02.17.dfsg.2-2"
},
{
"binary_name": "xemacs21-mulesupport",
"binary_version": "2009.02.17.dfsg.2-2"
},
{
"binary_name": "xemacs21-mulesupport-el",
"binary_version": "2009.02.17.dfsg.2-2"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21",
"binary_version": "21.4.24-5ubuntu1"
},
{
"binary_name": "xemacs21-bin",
"binary_version": "21.4.24-5ubuntu1"
},
{
"binary_name": "xemacs21-mule",
"binary_version": "21.4.24-5ubuntu1"
},
{
"binary_name": "xemacs21-mule-canna-wnn",
"binary_version": "21.4.24-5ubuntu1"
},
{
"binary_name": "xemacs21-nomule",
"binary_version": "21.4.24-5ubuntu1"
},
{
"binary_name": "xemacs21-support",
"binary_version": "21.4.24-5ubuntu1"
},
{
"binary_name": "xemacs21-supportel",
"binary_version": "21.4.24-5ubuntu1"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21-basesupport",
"binary_version": "2009.02.17.dfsg.2-4"
},
{
"binary_name": "xemacs21-basesupport-el",
"binary_version": "2009.02.17.dfsg.2-4"
},
{
"binary_name": "xemacs21-mulesupport",
"binary_version": "2009.02.17.dfsg.2-4"
},
{
"binary_name": "xemacs21-mulesupport-el",
"binary_version": "2009.02.17.dfsg.2-4"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21",
"binary_version": "21.4.24-9"
},
{
"binary_name": "xemacs21-bin",
"binary_version": "21.4.24-9"
},
{
"binary_name": "xemacs21-mule",
"binary_version": "21.4.24-9"
},
{
"binary_name": "xemacs21-mule-canna-wnn",
"binary_version": "21.4.24-9"
},
{
"binary_name": "xemacs21-nomule",
"binary_version": "21.4.24-9"
},
{
"binary_name": "xemacs21-support",
"binary_version": "21.4.24-9"
},
{
"binary_name": "xemacs21-supportel",
"binary_version": "21.4.24-9"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21-basesupport",
"binary_version": "2009.02.17.dfsg.2-5"
},
{
"binary_name": "xemacs21-basesupport-el",
"binary_version": "2009.02.17.dfsg.2-5"
},
{
"binary_name": "xemacs21-mulesupport",
"binary_version": "2009.02.17.dfsg.2-5"
},
{
"binary_name": "xemacs21-mulesupport-el",
"binary_version": "2009.02.17.dfsg.2-5"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21",
"binary_version": "21.4.24-9ubuntu2"
},
{
"binary_name": "xemacs21-bin",
"binary_version": "21.4.24-9ubuntu2"
},
{
"binary_name": "xemacs21-mule",
"binary_version": "21.4.24-9ubuntu2"
},
{
"binary_name": "xemacs21-mule-canna-wnn",
"binary_version": "21.4.24-9ubuntu2"
},
{
"binary_name": "xemacs21-nomule",
"binary_version": "21.4.24-9ubuntu2"
},
{
"binary_name": "xemacs21-support",
"binary_version": "21.4.24-9ubuntu2"
},
{
"binary_name": "xemacs21-supportel",
"binary_version": "21.4.24-9ubuntu2"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21-basesupport",
"binary_version": "2009.02.17.dfsg.2-5"
},
{
"binary_name": "xemacs21-basesupport-el",
"binary_version": "2009.02.17.dfsg.2-5"
},
{
"binary_name": "xemacs21-mulesupport",
"binary_version": "2009.02.17.dfsg.2-5"
},
{
"binary_name": "xemacs21-mulesupport-el",
"binary_version": "2009.02.17.dfsg.2-5"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-bin",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-mule",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-mule-canna-wnn",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-nomule",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-support",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-supportel",
"binary_version": "21.4.24-12build3"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21-basesupport",
"binary_version": "2009.02.17.dfsg.3-3"
},
{
"binary_name": "xemacs21-basesupport-el",
"binary_version": "2009.02.17.dfsg.3-3"
},
{
"binary_name": "xemacs21-mulesupport",
"binary_version": "2009.02.17.dfsg.3-3"
},
{
"binary_name": "xemacs21-mulesupport-el",
"binary_version": "2009.02.17.dfsg.3-3"
}
]
}{
"binaries": [
{
"binary_name": "emacs",
"binary_version": "1:30.2+1-2ubuntu1"
},
{
"binary_name": "emacs-bin-common",
"binary_version": "1:30.2+1-2ubuntu1"
},
{
"binary_name": "emacs-common",
"binary_version": "1:30.2+1-2ubuntu1"
},
{
"binary_name": "emacs-el",
"binary_version": "1:30.2+1-2ubuntu1"
},
{
"binary_name": "emacs-gtk",
"binary_version": "1:30.2+1-2ubuntu1"
},
{
"binary_name": "emacs-lucid",
"binary_version": "1:30.2+1-2ubuntu1"
},
{
"binary_name": "emacs-nox",
"binary_version": "1:30.2+1-2ubuntu1"
},
{
"binary_name": "emacs-pgtk",
"binary_version": "1:30.2+1-2ubuntu1"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-bin",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-mule",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-mule-canna-wnn",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-nomule",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-support",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-supportel",
"binary_version": "21.4.24-12build3"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21-basesupport",
"binary_version": "2009.02.17.dfsg.3-3build1"
},
{
"binary_name": "xemacs21-basesupport-el",
"binary_version": "2009.02.17.dfsg.3-3build1"
},
{
"binary_name": "xemacs21-mulesupport",
"binary_version": "2009.02.17.dfsg.3-3build1"
},
{
"binary_name": "xemacs21-mulesupport-el",
"binary_version": "2009.02.17.dfsg.3-3build1"
}
]
}{
"binaries": [
{
"binary_name": "emacs24",
"binary_version": "24.5+1-6ubuntu1.1+esm4"
},
{
"binary_name": "emacs24-bin-common",
"binary_version": "24.5+1-6ubuntu1.1+esm4"
},
{
"binary_name": "emacs24-common",
"binary_version": "24.5+1-6ubuntu1.1+esm4"
},
{
"binary_name": "emacs24-el",
"binary_version": "24.5+1-6ubuntu1.1+esm4"
},
{
"binary_name": "emacs24-lucid",
"binary_version": "24.5+1-6ubuntu1.1+esm4"
},
{
"binary_name": "emacs24-nox",
"binary_version": "24.5+1-6ubuntu1.1+esm4"
}
]
}{
"binaries": [
{
"binary_name": "emacs25",
"binary_version": "25.2+1-6ubuntu0.1~esm2"
},
{
"binary_name": "emacs25-bin-common",
"binary_version": "25.2+1-6ubuntu0.1~esm2"
},
{
"binary_name": "emacs25-common",
"binary_version": "25.2+1-6ubuntu0.1~esm2"
},
{
"binary_name": "emacs25-el",
"binary_version": "25.2+1-6ubuntu0.1~esm2"
},
{
"binary_name": "emacs25-lucid",
"binary_version": "25.2+1-6ubuntu0.1~esm2"
},
{
"binary_name": "emacs25-nox",
"binary_version": "25.2+1-6ubuntu0.1~esm2"
}
]
}{
"binaries": [
{
"binary_name": "emacs",
"binary_version": "1:26.3+1-1ubuntu2+esm2"
},
{
"binary_name": "emacs-bin-common",
"binary_version": "1:26.3+1-1ubuntu2+esm2"
},
{
"binary_name": "emacs-common",
"binary_version": "1:26.3+1-1ubuntu2+esm2"
},
{
"binary_name": "emacs-el",
"binary_version": "1:26.3+1-1ubuntu2+esm2"
},
{
"binary_name": "emacs-gtk",
"binary_version": "1:26.3+1-1ubuntu2+esm2"
},
{
"binary_name": "emacs-lucid",
"binary_version": "1:26.3+1-1ubuntu2+esm2"
},
{
"binary_name": "emacs-nox",
"binary_version": "1:26.3+1-1ubuntu2+esm2"
}
]
}{
"binaries": [
{
"binary_name": "emacs",
"binary_version": "1:27.1+1-3ubuntu5.2+esm1"
},
{
"binary_name": "emacs-bin-common",
"binary_version": "1:27.1+1-3ubuntu5.2+esm1"
},
{
"binary_name": "emacs-common",
"binary_version": "1:27.1+1-3ubuntu5.2+esm1"
},
{
"binary_name": "emacs-el",
"binary_version": "1:27.1+1-3ubuntu5.2+esm1"
},
{
"binary_name": "emacs-gtk",
"binary_version": "1:27.1+1-3ubuntu5.2+esm1"
},
{
"binary_name": "emacs-lucid",
"binary_version": "1:27.1+1-3ubuntu5.2+esm1"
},
{
"binary_name": "emacs-nox",
"binary_version": "1:27.1+1-3ubuntu5.2+esm1"
}
]
}{
"binaries": [
{
"binary_name": "emacs",
"binary_version": "1:29.3+1-1ubuntu2+esm3"
},
{
"binary_name": "emacs-bin-common",
"binary_version": "1:29.3+1-1ubuntu2+esm3"
},
{
"binary_name": "emacs-common",
"binary_version": "1:29.3+1-1ubuntu2+esm3"
},
{
"binary_name": "emacs-el",
"binary_version": "1:29.3+1-1ubuntu2+esm3"
},
{
"binary_name": "emacs-gtk",
"binary_version": "1:29.3+1-1ubuntu2+esm3"
},
{
"binary_name": "emacs-lucid",
"binary_version": "1:29.3+1-1ubuntu2+esm3"
},
{
"binary_name": "emacs-nox",
"binary_version": "1:29.3+1-1ubuntu2+esm3"
},
{
"binary_name": "emacs-pgtk",
"binary_version": "1:29.3+1-1ubuntu2+esm3"
}
]
}