CVE-2015-3905

What it actually does

Buffer overflow in set_cs_start function in t1disasm.c allows remote attackers to trigger denial of service via crash and potentially execute arbitrary code through a specially crafted font file.

Why it matters to the business

Systems processing untrusted font files with vulnerable t1utils versions risk crashes or full compromise, potentially disrupting font-related workflows in legacy environments where the package remains installed.

How an attack unfolds

An attacker crafts a malicious font file containing oversized data targeting the set_cs_start function and supplies it to any process invoking t1disasm or equivalent parsing logic in affected t1utils versions, leading to memory corruption and possible code execution; public exploits have been available since shortly after the 2015 disclosure.

How to fix it

Upgrade t1utils to version 1.39 or later on all affected systems; where upgrades are not feasible, restrict processing of untrusted font files and consider removing the package if unused.

How to confirm the fix worked

Verify installed t1utils version is 1.39 or higher; test parsing of known-good and known-bad font samples to confirm absence of crash or overflow behavior.

Typical attack path

1. Identify or obtain a target system with t1utils < 1.39 installed
2. Craft a malicious font file exploiting the set_cs_start buffer overflow
3. Deliver the font file to a process that invokes t1disasm
4. Trigger parsing to cause memory corruption and achieve denial of service or code execution

How to detect it

Review system and application logs for repeated crashes or segmentation faults involving t1disasm processes; inspect any historical file-processing events that reference suspicious or externally sourced font files.

What your security team should do

• Inventory all systems for t1utils package presence and version
• Prioritize upgrade to 1.39+ on any internet-facing or multi-user systems
• Remove t1utils where font disassembly functionality is not required
• Monitor for new EPSS increases or exploit publications given the existing public exploit maturity