Astra Linux – Vulnerability in FontForge

Splinefont in FontForge, with a version number of 20230101, allows for command injection through crafted archives or compressed files...

CVE-2024-25082_CVE-2024-25081

⚠️ FontForge RCE — CVE-2024-25081 和 CVE-2024-25082 - 概念验证 📖 概述 针对 FontForge ≤ 20230101 （Splinefont 组件）中两个命令注入漏洞的概念验证利用。 CVE| 攻击向量| 触发方式 ---|---|--- CVE-2024-25081| 构造的文件名| 直接打开文件 CVE-2024-25082| 构造的存档文件名| TAR/ZIP/GZ/BZ2 解压 本 PoC 针对 CVE-2024-25082 —— FontForge 的自动存档解压功能未对文件名进行转义处理，直接传入 shell，从而允许嵌入...

Astra Linux – Vulnerability in FontForge

Splinefont in FontForge, with a version number of 20230101, allows for command injection via crafted filenames...

fontforge: command injection via crafted archives or compressed files

Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files...

fontforge: command injection via crafted filenames

Splinefont in FontForge through 20230101 allows command injection via crafted filenames...

fontforge: command injection via crafted filenames

Splinefont in FontForge through 20230101 allows command injection via crafted filenames...

fontforge: command injection via crafted archives or compressed files

Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files...

fontforge: command injection via crafted filenames

Splinefont in FontForge through 20230101 allows command injection via crafted filenames...

MGASA-2024-0082 Updated fontforge packages fix security vulnerabilities

Splinefont in FontForge through 20230101 allows command injection via crafted filenames. CVE-2024-25081 Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files. CVE-2024-25082...

Medium: fontforge

Issue Overview: Splinefont in FontForge through 20230101 allows command injection via crafted filenames. CVE-2024-25081 Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files. CVE-2024-25082 Affected Packages: fontforge Issue Correction: Run dnf...

Amazon Linux 2 : fontforge (ALAS-2024-2495)

The version of fontforge installed on the remote host is prior to 20120731b-13. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2495 advisory. Splinefont in FontForge through 20230101 allows command injection via crafted filenames. CVE-2024-25081 Splinefont ...

Medium: fontforge

Issue Overview: Splinefont in FontForge through 20230101 allows command injection via crafted filenames. CVE-2024-25081 Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files. CVE-2024-25082 Affected Packages: fontforge Note: This advisory is...

Medium: fontforge

Issue Overview: Splinefont in FontForge through 20230101 allows command injection via crafted filenames. CVE-2024-25081 Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files. CVE-2024-25082 Affected Packages: fontforge Note: This advisory is...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : fontforge (SUSE-SU-2024:0864-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0864-1 advisory. - CVE-2024-25081: Fixed command injection via crafted filenames bsc1220404. - CVE-2024-25082:...

OESA-2024-1228 fontforge security update

FontForge former PfaEdit is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript ASCII and binary Type 1, some Type 3 and Type 0, TrueType, OpenType Type2 and CID-keyed fonts. Security Fixes: Splinefont in FontForge through 20230101 allows command...

SUSE CVE-2024-25082

Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files...

SUSE CVE-2024-25081

Splinefont in FontForge through 20230101 allows command injection via crafted filenames...

CVE-2024-25082

Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files...

CVE-2024-25081

Splinefont in FontForge through 20230101 allows command injection via crafted filenames...

CVE-2024-25081

Splinefont in FontForge through 20230101 allows command injection via crafted filenames...