Font Parsing Vulnerabilities

yahoo-security.tumblr.com

32 points·Jahak··6 comments

I worked on font parsing at one point. Indeed, the font rendering libraries are fragile and the formats complex and poorly documented.

This is a case of something being initially designed without security in mind, because fonts were something you bought and installed on your computer like applications. Suddenly, fonts were being automatically downloaded and rendered on web pages.

Auditing font libraries is hard, because you need combined expertise in security and font rendering (which is deeply intricate, especially with full non-Western writing system support.) I expect to see more vulnerabilities here.

Indeed, font parsing has been a focal point for browser security for awhile too; Chris and John (both of whom worked at Matasano, #shameless) have been hunting for bugs in them for years. It's good of Yahoo to pay them to do it publicly like this.

This was %100 Johns work.

Do these vulnerabilities suggest that attackers can gain access to your machine by sending an evil font to your browser? I wish this was getting more press/discussion.

Yes. But without icon fonts, the web would look like it did in 2008. And you don't want that, do you?

Browser vendors / web standards continue to expand the set of functionality that a browser provides. Each time they do so, they increase the attack surface.

Reply on news.ycombinator.com