medium6.5
CVE-2024-25082
Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.
Impact
Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fontforge | Fontforge | through 20230101 |
| Debian | Debian Linux | Version 10.0 |
| Fedoraproject | Fedora | Version 40 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.openwall.com/lists/oss-security/2024/03/08/2
- https://fontforge.org/en-US/downloads/
- https://github.com/fontforge/fontforge/pull/5367
- https://lists.debian.org/debian-lts-announce/2024/03/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCH22HIO2C6M4BZWF5EYIWVFBXL5BQAH/
- http://www.openwall.com/lists/oss-security/2024/03/08/2
- https://fontforge.org/en-US/downloads/
- https://github.com/fontforge/fontforge/pull/5367
- https://lists.debian.org/debian-lts-announce/2024/03/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCH22HIO2C6M4BZWF5EYIWVFBXL5BQAH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCH22HIO2C6M4BZWF5EYIWVFBXL5BQAH/