Alerts This Week
Warning Icon 1 1,154
Alerts This Week
Warning Icon 1 1,154

Debian 10 DLA-3754-1 Moderate: FontForge Command Injection Issues

debian lts
Calendar Grey March 7, 2024
Dist Debian Esm H88
A range of security flaws in FontForge has been addressed through a recent Debian update. Users are advised to perform an upgrade.
Multiple vulnerabilities have been fixed in the font editor FontForge
Topics%20covered

Topics Covered

security advisory buffer overflow debian command injection fontforge

Summary

CVE-2020-5395

Use-after-free in SFD_GetFontMetaData()

CVE-2020-5496

Buffer overflow in Type2NotDefSplines()

CVE-2024-25081

Spline Font command injection via crafted filenames

CVE-2024-25082

Spline Font command injection via crafted archives or compressed files


For Debian 10 buster, these problems have been fixed in version
1:20170731~dfsg-1+deb10u1.

We recommend that you upgrade your fontforge packages.

For the detailed security status of fontforge please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/fontforge

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Package: fontforge
Version: 1:20170731~dfsg-1+deb10u1
CVE ID: CVE-2020-5395 CVE-2020-5496 CVE-2024-25081 CVE-2024-25082
Debian Bug: 948231 1064967

Topics%20covered

Topics Covered

security advisory buffer overflow debian command injection fontforge

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here