GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in an undersized heap allocation. A subsequent read() call writes beyond the buffer, causing a heap buffer overflow. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This can lead to heap memory corruption and potential code execution. This issue was fixed in commit d51a4722316efe0960994d371e1859099894d1ca
{
"binaries": [
{
"binary_name": "xemacs21",
"binary_version": "21.4.22-14ubuntu1"
},
{
"binary_name": "xemacs21-bin",
"binary_version": "21.4.22-14ubuntu1"
},
{
"binary_name": "xemacs21-mule",
"binary_version": "21.4.22-14ubuntu1"
},
{
"binary_name": "xemacs21-mule-canna-wnn",
"binary_version": "21.4.22-14ubuntu1"
},
{
"binary_name": "xemacs21-nomule",
"binary_version": "21.4.22-14ubuntu1"
},
{
"binary_name": "xemacs21-support",
"binary_version": "21.4.22-14ubuntu1"
},
{
"binary_name": "xemacs21-supportel",
"binary_version": "21.4.22-14ubuntu1"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21-basesupport",
"binary_version": "2009.02.17.dfsg.2-2"
},
{
"binary_name": "xemacs21-basesupport-el",
"binary_version": "2009.02.17.dfsg.2-2"
},
{
"binary_name": "xemacs21-mulesupport",
"binary_version": "2009.02.17.dfsg.2-2"
},
{
"binary_name": "xemacs21-mulesupport-el",
"binary_version": "2009.02.17.dfsg.2-2"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21",
"binary_version": "21.4.24-5ubuntu1"
},
{
"binary_name": "xemacs21-bin",
"binary_version": "21.4.24-5ubuntu1"
},
{
"binary_name": "xemacs21-mule",
"binary_version": "21.4.24-5ubuntu1"
},
{
"binary_name": "xemacs21-mule-canna-wnn",
"binary_version": "21.4.24-5ubuntu1"
},
{
"binary_name": "xemacs21-nomule",
"binary_version": "21.4.24-5ubuntu1"
},
{
"binary_name": "xemacs21-support",
"binary_version": "21.4.24-5ubuntu1"
},
{
"binary_name": "xemacs21-supportel",
"binary_version": "21.4.24-5ubuntu1"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21-basesupport",
"binary_version": "2009.02.17.dfsg.2-4"
},
{
"binary_name": "xemacs21-basesupport-el",
"binary_version": "2009.02.17.dfsg.2-4"
},
{
"binary_name": "xemacs21-mulesupport",
"binary_version": "2009.02.17.dfsg.2-4"
},
{
"binary_name": "xemacs21-mulesupport-el",
"binary_version": "2009.02.17.dfsg.2-4"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21",
"binary_version": "21.4.24-9"
},
{
"binary_name": "xemacs21-bin",
"binary_version": "21.4.24-9"
},
{
"binary_name": "xemacs21-mule",
"binary_version": "21.4.24-9"
},
{
"binary_name": "xemacs21-mule-canna-wnn",
"binary_version": "21.4.24-9"
},
{
"binary_name": "xemacs21-nomule",
"binary_version": "21.4.24-9"
},
{
"binary_name": "xemacs21-support",
"binary_version": "21.4.24-9"
},
{
"binary_name": "xemacs21-supportel",
"binary_version": "21.4.24-9"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21-basesupport",
"binary_version": "2009.02.17.dfsg.2-5"
},
{
"binary_name": "xemacs21-basesupport-el",
"binary_version": "2009.02.17.dfsg.2-5"
},
{
"binary_name": "xemacs21-mulesupport",
"binary_version": "2009.02.17.dfsg.2-5"
},
{
"binary_name": "xemacs21-mulesupport-el",
"binary_version": "2009.02.17.dfsg.2-5"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21",
"binary_version": "21.4.24-9ubuntu2"
},
{
"binary_name": "xemacs21-bin",
"binary_version": "21.4.24-9ubuntu2"
},
{
"binary_name": "xemacs21-mule",
"binary_version": "21.4.24-9ubuntu2"
},
{
"binary_name": "xemacs21-mule-canna-wnn",
"binary_version": "21.4.24-9ubuntu2"
},
{
"binary_name": "xemacs21-nomule",
"binary_version": "21.4.24-9ubuntu2"
},
{
"binary_name": "xemacs21-support",
"binary_version": "21.4.24-9ubuntu2"
},
{
"binary_name": "xemacs21-supportel",
"binary_version": "21.4.24-9ubuntu2"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21-basesupport",
"binary_version": "2009.02.17.dfsg.2-5"
},
{
"binary_name": "xemacs21-basesupport-el",
"binary_version": "2009.02.17.dfsg.2-5"
},
{
"binary_name": "xemacs21-mulesupport",
"binary_version": "2009.02.17.dfsg.2-5"
},
{
"binary_name": "xemacs21-mulesupport-el",
"binary_version": "2009.02.17.dfsg.2-5"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-bin",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-mule",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-mule-canna-wnn",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-nomule",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-support",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-supportel",
"binary_version": "21.4.24-12build3"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21-basesupport",
"binary_version": "2009.02.17.dfsg.3-3"
},
{
"binary_name": "xemacs21-basesupport-el",
"binary_version": "2009.02.17.dfsg.3-3"
},
{
"binary_name": "xemacs21-mulesupport",
"binary_version": "2009.02.17.dfsg.3-3"
},
{
"binary_name": "xemacs21-mulesupport-el",
"binary_version": "2009.02.17.dfsg.3-3"
}
]
}{
"binaries": [
{
"binary_name": "emacs",
"binary_version": "1:30.2+1-2ubuntu1"
},
{
"binary_name": "emacs-bin-common",
"binary_version": "1:30.2+1-2ubuntu1"
},
{
"binary_name": "emacs-common",
"binary_version": "1:30.2+1-2ubuntu1"
},
{
"binary_name": "emacs-el",
"binary_version": "1:30.2+1-2ubuntu1"
},
{
"binary_name": "emacs-gtk",
"binary_version": "1:30.2+1-2ubuntu1"
},
{
"binary_name": "emacs-lucid",
"binary_version": "1:30.2+1-2ubuntu1"
},
{
"binary_name": "emacs-nox",
"binary_version": "1:30.2+1-2ubuntu1"
},
{
"binary_name": "emacs-pgtk",
"binary_version": "1:30.2+1-2ubuntu1"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-bin",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-mule",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-mule-canna-wnn",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-nomule",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-support",
"binary_version": "21.4.24-12build3"
},
{
"binary_name": "xemacs21-supportel",
"binary_version": "21.4.24-12build3"
}
]
}{
"binaries": [
{
"binary_name": "xemacs21-basesupport",
"binary_version": "2009.02.17.dfsg.3-3build1"
},
{
"binary_name": "xemacs21-basesupport-el",
"binary_version": "2009.02.17.dfsg.3-3build1"
},
{
"binary_name": "xemacs21-mulesupport",
"binary_version": "2009.02.17.dfsg.3-3build1"
},
{
"binary_name": "xemacs21-mulesupport-el",
"binary_version": "2009.02.17.dfsg.3-3build1"
}
]
}{
"binaries": [
{
"binary_name": "emacs24",
"binary_version": "24.5+1-6ubuntu1.1+esm4"
},
{
"binary_name": "emacs24-bin-common",
"binary_version": "24.5+1-6ubuntu1.1+esm4"
},
{
"binary_name": "emacs24-common",
"binary_version": "24.5+1-6ubuntu1.1+esm4"
},
{
"binary_name": "emacs24-el",
"binary_version": "24.5+1-6ubuntu1.1+esm4"
},
{
"binary_name": "emacs24-lucid",
"binary_version": "24.5+1-6ubuntu1.1+esm4"
},
{
"binary_name": "emacs24-nox",
"binary_version": "24.5+1-6ubuntu1.1+esm4"
}
]
}{
"binaries": [
{
"binary_name": "emacs25",
"binary_version": "25.2+1-6ubuntu0.1~esm2"
},
{
"binary_name": "emacs25-bin-common",
"binary_version": "25.2+1-6ubuntu0.1~esm2"
},
{
"binary_name": "emacs25-common",
"binary_version": "25.2+1-6ubuntu0.1~esm2"
},
{
"binary_name": "emacs25-el",
"binary_version": "25.2+1-6ubuntu0.1~esm2"
},
{
"binary_name": "emacs25-lucid",
"binary_version": "25.2+1-6ubuntu0.1~esm2"
},
{
"binary_name": "emacs25-nox",
"binary_version": "25.2+1-6ubuntu0.1~esm2"
}
]
}{
"binaries": [
{
"binary_name": "emacs",
"binary_version": "1:26.3+1-1ubuntu2+esm2"
},
{
"binary_name": "emacs-bin-common",
"binary_version": "1:26.3+1-1ubuntu2+esm2"
},
{
"binary_name": "emacs-common",
"binary_version": "1:26.3+1-1ubuntu2+esm2"
},
{
"binary_name": "emacs-el",
"binary_version": "1:26.3+1-1ubuntu2+esm2"
},
{
"binary_name": "emacs-gtk",
"binary_version": "1:26.3+1-1ubuntu2+esm2"
},
{
"binary_name": "emacs-lucid",
"binary_version": "1:26.3+1-1ubuntu2+esm2"
},
{
"binary_name": "emacs-nox",
"binary_version": "1:26.3+1-1ubuntu2+esm2"
}
]
}{
"binaries": [
{
"binary_name": "emacs",
"binary_version": "1:27.1+1-3ubuntu5.2+esm1"
},
{
"binary_name": "emacs-bin-common",
"binary_version": "1:27.1+1-3ubuntu5.2+esm1"
},
{
"binary_name": "emacs-common",
"binary_version": "1:27.1+1-3ubuntu5.2+esm1"
},
{
"binary_name": "emacs-el",
"binary_version": "1:27.1+1-3ubuntu5.2+esm1"
},
{
"binary_name": "emacs-gtk",
"binary_version": "1:27.1+1-3ubuntu5.2+esm1"
},
{
"binary_name": "emacs-lucid",
"binary_version": "1:27.1+1-3ubuntu5.2+esm1"
},
{
"binary_name": "emacs-nox",
"binary_version": "1:27.1+1-3ubuntu5.2+esm1"
}
]
}{
"binaries": [
{
"binary_name": "emacs",
"binary_version": "1:29.3+1-1ubuntu2+esm3"
},
{
"binary_name": "emacs-bin-common",
"binary_version": "1:29.3+1-1ubuntu2+esm3"
},
{
"binary_name": "emacs-common",
"binary_version": "1:29.3+1-1ubuntu2+esm3"
},
{
"binary_name": "emacs-el",
"binary_version": "1:29.3+1-1ubuntu2+esm3"
},
{
"binary_name": "emacs-gtk",
"binary_version": "1:29.3+1-1ubuntu2+esm3"
},
{
"binary_name": "emacs-lucid",
"binary_version": "1:29.3+1-1ubuntu2+esm3"
},
{
"binary_name": "emacs-nox",
"binary_version": "1:29.3+1-1ubuntu2+esm3"
},
{
"binary_name": "emacs-pgtk",
"binary_version": "1:29.3+1-1ubuntu2+esm3"
}
]
}