CVE-2024-25082

Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files...

CVE-2024-25081

FontForge (fontforge) is affected by CVE-2024-25081: command injection via crafted filenames in Splinefont up to version 20230101. Connected advisories confirm the issue also for crafted archives/compressed files (CVE-2024-25082) and indicate patches released in multiple distributions (e.g., Debi...