PatchTheCVEgraphite2 vulnerabilities and fixes
Recent CVEs affecting graphite2, with upgrade or downgrade steps. 7 tracked.
graphite2 has 7 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 6. Most recent: 2019-04-15. Highest priority: CVE-2017-7778 (score 67/100).
- CVE-2018-7999 HIGH 8.8 DOWNGRADE In libgraphite2 in graphite2 1.3.11, a NULL pointer dereference vulnerability was found in Segment.cpp during
- CVE-2017-7778 CRITICAL 9.8 UPGRADE UPGRADE A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow
- CVE-2017-7777 HIGH 8.8 UPGRADE UPGRADE Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_g
- CVE-2017-7776 HIGH 8.1 UPGRADE UPGRADE Heap-based Buffer Overflow read in Graphite2 library in Firefox before 54 in graphite2::Silf::getClassGlyph.
- CVE-2017-7774 CRITICAL 9.1 UPGRADE UPGRADE Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Silf::readGraphite function.
- CVE-2017-7773 HIGH 8.8 UPGRADE UPGRADE Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54 in lz4::decompress src/Decompressor
- CVE-2017-7771 HIGH 8.1 UPGRADE UPGRADE Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Pass::readPass function.
FAQ
How do I fix graphite2 vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is graphite2 being exploited right now?
None of the tracked graphite2 CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which graphite2 CVE should I patch first?
CVE-2017-7778 currently ranks highest (67/100): A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow .