CVE-2020-25690

An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. The highest threat...

CentOS 8 : fontforge (CESA-2020:1921)

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:1921 advisory. - fontforge: out-of-bounds write in SFDGetFontMetaData function in sfd.c CVE-2020-5395 Note that Nessus has not tested for this issue but has instead relied onl...

CentOS 8 : fontforge (CESA-2020:4844)

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:4844 advisory. - fontforge: SFDGetFontMetaData insufficient CVE-2020-5395 backport CVE-2020-25690 Note that Nessus has not tested for this issue but has instead relied only on...

Arbitrary Code Execution

fontforge is vulnerable to arbitrary code execution. A heap-based buffer overflow in the Type2NotDefSplines function in splinesave.c allows an attacker to execute arbitrary code...

openSUSE Security Update : fontforge (openSUSE-2020-2111)

This update for fontforge fixes the following issues : - fix for Use-after-free heap in the SFDGetFontMetaData function and the crash bsc1178308 CVE-2020-25690. This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc. The descriptive text and package...

SUSE-SU-2020:3628-1 Security update for fontforge

This update for fontforge fixes the following issues: - fix for Use-after-free heap in the SFDGetFontMetaData function and the crash bsc1178308 CVE-2020-25690...

OPENSUSE-SU-2020:2111-1 Security update for fontforge

This update for fontforge fixes the following issues: - fix for Use-after-free heap in the SFDGetFontMetaData function and the crash bsc1178308 CVE-2020-25690. This update was imported from the SUSE:SLE-15:Update update project...

Security update for fontforge (moderate)

openSUSE Security Update: Security update for fontforge Announcement ID: openSUSE-SU-2020:2111-1 Rating: moderate References: 1160220 1178308 Cross-References: CVE-2020-25690 CVE-2020-5395 Affected Products: openSUSE Leap 15.1 An update that fixes two vulnerabilities is now available. Description...

MGASA-2020-0405 Updated fontforge packages fix a security vulnerability

SFDGetFontMetaData insufficient CVE-2020-5395 backport. CVE-2020-25690...

Updated fontforge packages fix a security vulnerability

SFDGetFontMetaData insufficient CVE-2020-5395 backport. CVE-2020-25690...

Denial Of Service(DoS)

FontForge is vulnerable to denial of service DoS. The vulnerability exists because of an insufficient fix for CVE-2020-5395 backport...

Red Hat Enterprise Linux 8 Out-of-Bounds Write Vulnerability

Red Hat Enterprise Linux 8 is a Linux operating system for business users from Red Hat. An out-of-bounds write vulnerability exists in fontforge in Red Hat Enterprise Linux 8, which originates from an out-of-bounds write when parsing SFD files containing certain LayerCount tokens. An attacker cou...

fontforge: SFD_GetFontMetaData() insufficient CVE-2020-5395 backport

An out-of-bounds write flaw was found in FontForge while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. The highest threat from this vulnerability is t...

Moderate: Red Hat Security Advisory: fontforge security update

An update for fontforge is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

RHEL 8 : fontforge (RHSA-2020:4844)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:4844 advisory. FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript ASCII and binary Type 1, some Type...

Moderate: fontforge security update

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript ASCII and binary Type 1, some Type 3 and Type 0, TrueType, OpenType Type2 and CID-keyed fonts. Security Fixes: fontforge: SFDGetFontMetaData insufficient CVE-2020-5395 backport...

ALSA-2020:4844 Moderate: fontforge security update

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript ASCII and binary Type 1, some Type 3 and Type 0, TrueType, OpenType Type2 and CID-keyed fonts. Security Fixes: fontforge: SFDGetFontMetaData insufficient CVE-2020-5395 backport...

CVE-2020-25690

An out-of-bounds write flaw was found in FontForge while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. The highest threat from this vulnerability is t...

Amazon Linux 2 : fontforge (ALAS-2020-1514)

The version of fontforge installed on the remote host is prior to 20120731b-13. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1514 advisory. An out-of-bounds write was discovered in fontforge while parsing SFD files containing very large LayerCount tokens. The flaw...

Medium: fontforge

Issue Overview: An out-of-bounds write was discovered in fontforge while parsing SFD files containing very large LayerCount tokens. The flaw allows an attacker to overwrite data before a buffer allocated on the heap, thus causing the application to crash or execute arbitrary code. CVE-2020-5395...