The host is installed with Mozilla Firefox before 43.0, Firefox ESR 38.x before 38.6.1 or Thunderbird 38.x before 38.6 and is prone to an information disclosure vulnerability. A flaw is present in the applications, which fail to handle a crafted graphite smart font. Successful exploitation allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash).