CVE-2017-17521

2017-12-1416:29:00

Google

osv.dev

6.7 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

58.5%

JSON

uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17534.

CPENameOperatorVersion
fontforgeeq20150228
fontforgeeq20140813
fontforgeeq20150612
fontforgeeq20170730
fontforgeeq2.0.20140101
fontforgeeq20141014
fontforgeeq20120731-b
fontforgeeq20150824
fontforgeeq20160930
fontforgeeq20161001

Name	Operator	Version
fontforge	eq	20150228
fontforge	eq	20140813
fontforge	eq	20150612
fontforge	eq	20170730
fontforge	eq	2.0.20140101
fontforge	eq	20141014
fontforge	eq	20120731-b
fontforge	eq	20150824
fontforge	eq	20160930
fontforge	eq	20161001