

Font Parsing Vulnerabilities - Jahak
http://yahoo-security.tumblr.com/post/123981052855

======
tlb
I worked on font parsing at one point. Indeed, the font rendering libraries
are fragile and the formats complex and poorly documented.

This is a case of something being initially designed without security in mind,
because fonts were something you bought and installed on your computer like
applications. Suddenly, fonts were being automatically downloaded and rendered
on web pages.

Auditing font libraries is hard, because you need combined expertise in
security and font rendering (which is deeply intricate, especially with full
non-Western writing system support.) I expect to see more vulnerabilities
here.

~~~
tptacek
Indeed, font parsing has been a focal point for browser security for awhile
too; Chris and John (both of whom worked at Matasano, #shameless) have been
hunting for bugs in them for years. It's good of Yahoo to pay them to do it
publicly like this.

~~~
chrisrohlf
This was %100 Johns work.

------
gurgeous
Do these vulnerabilities suggest that attackers can gain access to your
machine by sending an evil font to your browser? I wish this was getting more
press/discussion.

~~~
tedunangst
Yes. But without icon fonts, the web would look like it did in 2008. And you
don't want that, do you?

------
nfoz
Browser vendors / web standards continue to expand the set of functionality
that a browser provides. Each time they do so, they increase the attack
surface.

