Heap-Based Buffer Over-Read in STB Truetype Library
CVE-2020-6621

8.8HIGH

Key Information:

Vendor

Nothings

Status
Stb Truetype.h
Vendor
CVE Published:
8 January 2020

What is CVE-2020-6621?

The STB Truetype Library, specifically versions preceding 1.22, contains a vulnerability characterized by a heap-based buffer over-read in the function ttUSHORT. This flaw can potentially be exploited by attackers to gain unauthorized access to sensitive data, leading to severe security implications for applications utilizing this library. Developers are recommended to review and update their versions to mitigate any associated risks.

References

https://github.com/nothings/stb/issues/867
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.