1 matches found
MGASA-2024-0060 Updated fonttools packages fix security vulnerabilities
As of fonttools=4.28.2 the subsetting module has a XML External Entity Injection XXE vulnerability which allows an attacker to resolve arbitrary entities when a candidate font OT-SVG fonts, which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem...
7.5CVSS7.5AI score0.01238EPSS
SaveExploits1References4
20