Lucene search

K

Veracode Vulnerability DatabaseVERACODE:45855

HistoryMar 13, 2024 - 3:31 p.m.

Command Injection

2024-03-1315:31:24

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

5

fontforge

command injection

input validation

malicious actors

filenames

unintended commands

6.7 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.7%

FontForge is vulnerable to Command Injection. The vulnerability is due to insufficient input validation, which enables malicious actors to manipulate filenames in a way that triggers the execution of unintended commands.

CPENameOperatorVersion
fontforge:sideq1:20201107~dfsg-2
fontforge:bullseyeeq1:20190801~dfsg-4
fontforge:sideq1:20201107~dfsg-2
fontforge:bullseyeeq1:20190801~dfsg-4

References

www.openwall.com/lists/oss-security/2024/03/08/2

fontforge.org/en-US/downloads/

github.com/fontforge/fontforge/pull/5367

lists.debian.org/debian-lts-announce/2024/03/msg00007.html

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCH22HIO2C6M4BZWF5EYIWVFBXL5BQAH/

security-tracker.debian.org/tracker/CVE-2024-25081

6.7 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.7%

Related for VERACODE:45855

osv3 redhatcve1 ubuntucve1 debiancve1 prion1 cvelist1 nvd1 cve1 nessus7 fedora1 openvas5 debian2 mageia1 amazon1