Remote Code Execution (RCE)

libfontforge.so is vulnerable to remote code execution RCE attacks. A malicious user can pass an otf file to the strnmatch function in char.c to cause a buffer overflow that can crash the application or cause arbitrary code to be executed...

CVE-2017-11576

FontForge 20161012 does not ensure a positive size in a weight vector memcpy call in readcfftopdict parsettf.c resulting in DoS via a crafted otf file...