Remote Code Execution (RCE)

libfontforge.so is vulnerable to remote code execution RCE attacks. A malicious user can pass an otf file to the strnmatch function in char.c to cause a buffer overflow that can crash the application or cause arbitrary code to be executed...

CVE-2017-11575

FontForge 20161012 is affected by CVE-2017-11575: a buffer over-read in strnmatch (char.c) can trigger DoS or code execution via a crafted OpenType font, linked to readttfcopyrights in parsettf.c. Multiple advisories confirm the issue and document fixes in later FontForge releases (e.g., updates ...