1

There were some kernel exploits and CVEs (for example ms11-087 and CVE-2017-8682) about fonts. And there were some malware campaigns like duqu which used zerodays in fonts embedded into docx files.

I wonder if it is secure to open PDF and other document files with embedded/linked fonts and images (the most of PDF files have them embedded, the most of webpages have images and very large share of them use site-provided fonts). I mean if modern viewers pass this kind of stuff to the OS and kernel, or do they deal with the formats purely in userland in their own processes using some libraries and which one does what?

1

Opening a document is only secure if all the components used to edit/display it contains no security flaws.

If a security flaw exists in the software used to display/edit the document or in any component (library or service) that it uses to process some elements like images or fonts, a specially crafted document can exploit the security flaw.

What it actually attacked here is not the document itself but one specific program or library that is used to process it. Said differently a rogue document could exploit the security flaw when edited with software A but not with software B.

  • It doesn't answer my question. My question was about certain mitigation measures in well-known software. I mewn if you pass a pdf with an exploit for a kernel vuln in font processing to Acrobat, Foxit, MuPDF, SumatraPDF, PDF.js etc, will it work? If you open a webpage with the exploit font linked in Firefox and Chrome, will it work? I don't take into account vulnr in parsing PDF or HTML here, I wonder if the programs use the third-party privileged component for that - the OS kernel. – KOLANICH Feb 4 '18 at 10:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.