fontforge vulnerabilities

2024-06-2709:52:34

Google

osv.dev

fontforge

vulnerabilities

filenames

file handling

command injection

cve-2024-25081

archives

compressed files

cve-2024-25082

remote attacker

7.4 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.7%

JSON

It was discovered that FontForge incorrectly handled filenames. If a user or an
automated system were tricked into opening a specially crafted input file, a
remote attacker could possibly use this issue to perform a command injection.
(CVE-2024-25081)

It was discovered that FontForge incorrectly handled archives and compressed
files. If a user or an automated system were tricked into opening a specially
crafted input file, a remote attacker could possibly use this issue to perform
command injection. (CVE-2024-25082)