Buffer overflow in the set_cs_start function in t1disasm.c in t1utils before 1.39 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Buffer overflow in the set_cs_start function in t1disasm.c in t1utils before 1.39 allows remote attackers     to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.
    (CVE-2015-3905)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-201507-10 (t1utils: Arbitrary code execution)

    t1utils has a buffer overflow in the set_cs_start function in       t1disasm.c.
  Impact :

    A remote attacker could cause a denial of service and possibly execute       arbitrary code via a crafted font file.
  Workaround :

    There is no known workaround at this time.

Jakub Wilk found a vulnerability in the Type 1 font manipulation programs, t1utils :

CVE-2015-3905

Buffer overflow in the set_cs_start function in t1disasm.c in t1utils before 1.39 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.

For Debian 6 'Squeeze', this issue has been fixed in t1utils version 1.36-1+deb6u1.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow flaw was found in the way t1utils processed, for example, certain PFB (Printer Font Binary) files. An attacker could use this flaw to potentially execute arbitrary code by tricking a user into processing a specially crafted PFB file with t1utils.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2627-1 advisory.

    Jakub Wilk discovered that t1utils incorrectly handled certain malformed fonts. If a user or automated     system were tricked into opening a specially crafted font, a remote attacker could crash the application,     leading to a denial of service, or possibly execute arbitrary code with user privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
218820	Linux Distros Unpatched Vulnerability : CVE-2015-3905	Nessus	Misc.	critical
86081	GLSA-201507-10 : t1utils: Arbitrary code execution	Nessus	Gentoo Local Security Checks	high
84434	Debian DLA-256-1 : t1utils security update	Nessus	Debian Local Security Checks	high
84371	Amazon Linux AMI : t1utils (ALAS-2015-554)	Nessus	Amazon Linux Local Security Checks	high
83990	Ubuntu 14.04 LTS : t1utils vulnerability (USN-2627-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2015-3905

high

Tenable Plugins

critical

high

high

high

high