Lucene search

Veracode Vulnerability DatabaseVERACODE:45856

HistoryMar 13, 2024 - 3:31 p.m.

Command Injection

2024-03-1315:31:42

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

command injection

vulnerability

fontforge

crafted files

6.7 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.7%

JSON

fontforge is vulnerable to Command Injection.The vulnerability is due to improper handling of crafted archives or compressed files.

CPENameOperatorVersion
fontforge:sideq1:20201107~dfsg-2
fontforge:bullseyeeq1:20190801~dfsg-4
fontforge:sideq1:20201107~dfsg-2
fontforge:bullseyeeq1:20190801~dfsg-4

Name	Operator	Version
fontforge:sid	eq	1:20201107~dfsg-2
fontforge:bullseye	eq	1:20190801~dfsg-4
fontforge:sid	eq	1:20201107~dfsg-2
fontforge:bullseye	eq	1:20190801~dfsg-4

References

www.openwall.com/lists/oss-security/2024/03/08/2

fontforge.org/en-US/downloads/

github.com/fontforge/fontforge/pull/5367

lists.debian.org/debian-lts-announce/2024/03/msg00007.html

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCH22HIO2C6M4BZWF5EYIWVFBXL5BQAH/

security-tracker.debian.org/tracker/CVE-2024-25082