831 matches found
FontForge Security Vulnerability
FontForge is an open source font editing tool that supports multiple languages. A security vulnerability exists in FontForge 20230101 and earlier versions, which stems from a command injection allowed via specially crafted archives or compressed files...
PT-2024-1850
Name of the Vulnerable Software and Affected Versions FontForge versions through 20230101 Description The issue exists due to the lack of neutralization of special elements in the software. This can allow an attacker to execute arbitrary commands via crafted filenames. The estimated number of...
CVE-2024-25081
Splinefont in FontForge through 20230101 allows command injection via crafted filenames...
CVE-2024-25082
Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files...
CVE-2024-25082
Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files...
CVE-2024-25081
Splinefont in FontForge through 20230101 allows command injection via crafted filenames...
CVE-2024-25081
FontForge (fontforge) is affected by CVE-2024-25081: command injection via crafted filenames in Splinefont up to version 20230101. Connected advisories confirm the issue also for crafted archives/compressed files (CVE-2024-25082) and indicate patches released in multiple distributions (e.g., Debi...
Oracle Linux 8 : fontforge (ELSA-2020-1921)
The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-1921 advisory. 20170731-14 - Resolves:rh1790974 - CVE-2020-5395:out-of-bounds write in sfd.c Tenable has extracted the preceding description block directly from the Oracle Lin...
SUSE CVE-2010-4259
Stack-based buffer overflow in FontForge 20100501 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a long CHARSETREGISTRY header in a BDF font file...
SUSE CVE-2017-11570
FontForge 20161012 is vulnerable to a buffer over-read in umodenc parsettf.c resulting in DoS or code execution via a crafted otf file...
SUSE CVE-2017-11571
FontForge 20161012 is vulnerable to a stack-based buffer overflow in addnibble parsettf.c resulting in DoS or code execution via a crafted otf file...
SUSE CVE-2017-11569
FontForge 20161012 is vulnerable to a heap-based buffer over-read in readttfcopyrights parsettf.c resulting in DoS or code execution via a crafted otf file...
SUSE CVE-2017-11568
FontForge 20161012 is vulnerable to a heap-based buffer over-read in PSCharStringToSplines psread.c resulting in DoS or code execution via a crafted otf file...
SUSE CVE-2017-11572
FontForge 20161012 is vulnerable to a heap-based buffer over-read in readcfftopdicts parsettf.c resulting in DoS or code execution via a crafted otf file...
SUSE CVE-2017-11573
FontForge 20161012 is vulnerable to a buffer over-read in ValidatePostScriptFontName parsettf.c resulting in DoS or code execution via a crafted otf file...
SUSE CVE-2017-11577
FontForge 20161012 is vulnerable to a buffer over-read in getsid parsettf.c resulting in DoS or code execution via a crafted otf file...
SUSE CVE-2017-11576
FontForge 20161012 does not ensure a positive size in a weight vector memcpy call in readcfftopdict parsettf.c resulting in DoS via a crafted otf file...
SUSE CVE-2017-11575
FontForge 20161012 is vulnerable to a buffer over-read in strnmatch char.c resulting in DoS or code execution via a crafted otf file, related to a call from the readttfcopyrights function in parsettf.c...
SUSE CVE-2017-17521
uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17534...