CVE-2024-25081

2024-02-2616:27:58

Debian Security Bug Tracker

security-tracker.debian.org

fontforge

splinefont

command injection

unix

20230101

7.6 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.7%

JSON

Splinefont in FontForge through 20230101 allows command injection via crafted filenames.

OSVersionArchitecturePackageVersionFilename
Debian12allfontforge< 1:20230101~dfsg-1.1~deb12u1fontforge_1:20230101~dfsg-1.1~deb12u1_all.deb
Debian11allfontforge< 1:20201107~dfsg-4+deb11u1fontforge_1:20201107~dfsg-4+deb11u1_all.deb
Debian10allfontforge< 1:20170731~dfsg-1+deb10u1fontforge_1:20170731~dfsg-1+deb10u1_all.deb
Debian999allfontforge< 1:20230101~dfsg-1.1fontforge_1:20230101~dfsg-1.1_all.deb
Debian13allfontforge< 1:20230101~dfsg-1.1fontforge_1:20230101~dfsg-1.1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	fontforge	< 1:20230101~dfsg-1.1~deb12u1	fontforge_1:20230101~dfsg-1.1~deb12u1_all.deb
Debian	11	all	fontforge	< 1:20201107~dfsg-4+deb11u1	fontforge_1:20201107~dfsg-4+deb11u1_all.deb
Debian	10	all	fontforge	< 1:20170731~dfsg-1+deb10u1	fontforge_1:20170731~dfsg-1+deb10u1_all.deb
Debian	999	all	fontforge	< 1:20230101~dfsg-1.1	fontforge_1:20230101~dfsg-1.1_all.deb
Debian	13	all	fontforge	< 1:20230101~dfsg-1.1	fontforge_1:20230101~dfsg-1.1_all.deb