| Name | CVE-2015-3905 |
| Description | Buffer overflow in the set_cs_start function in t1disasm.c in t1utils before 1.39 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-256-1 |
| Debian Bugs | 779274 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| t1utils (PTS) | jessie | 1.38-4 | fixed |
| stretch | 1.39-2 | fixed |
| buster | 1.41-3 | fixed |
| sid, trixie, bullseye, bookworm | 1.41-4 | fixed |
The information below is based on the following data on fixed versions.
Notes
[wheezy] - t1utils <no-dsa> (Minor issue)
https://github.com/kohler/t1utils/issues/4
https://www.openwall.com/lists/oss-security/2015/05/13/9