CVE-2015-8872

What it actually does

The set_fat function in fat.c triggers an off-by-two error on FAT12 filesystems when an odd number of clusters is written to the third-to-last entry, resulting in an invalid memory read and process crash or filesystem corruption.

Why it matters to the business

Affected systems risk denial-of-service crashes or data corruption on FAT12 volumes; the issue is old with negligible EPSS and no known exploitation, limiting operational urgency but requiring patching of long-supported distributions.

How an attack unfolds

An attacker prepares a specially crafted FAT12 image containing an odd cluster count in the target FAT entry; when the vulnerable code processes the image locally the off-by-two read occurs, crashing the process or corrupting the filesystem.

How to fix it

Upgrade fontforge packages to the listed fixed versions: Debian 11/12/13 to 1:20170731~dfsg-1; Ubuntu 14.04 LTS to 20120731.b-5ubuntu0.1; Ubuntu 16.04 LTS to 20120731.b-7.1ubuntu0.1; Ubuntu 18.04 LTS to 1:20170731~dfsg-1. Remove or isolate unpatched instances.

How to confirm the fix worked

Confirm installed package versions match or exceed the fixed releases for each distribution; attempt to mount or process a test FAT12 image that exercises the third-to-last entry path and verify absence of crash or corruption.

Typical attack path

1. Create a malicious FAT12 filesystem image with the triggering cluster pattern
2. Place the image on a system running an affected package version
3. Cause local processing of the image to trigger the memory read error
4. Observe crash or filesystem corruption

How to detect it

Review system and application logs for unexpected fontforge or filesystem-tool crashes occurring during FAT12 image handling; correlate with creation or access of unusual .img or filesystem files around the time of the crash.

What your security team should do

• Apply the distribution-specific package updates immediately on all affected hosts
• Scan package inventories for remaining vulnerable fontforge versions
• Add the fixed-version checks to routine patch compliance reporting