Alerts This Week
Warning Icon 1 1,149
Alerts This Week
Warning Icon 1 1,149

Ubuntu 22.04 LTS: fontTools Important Path Traversal Risk CVE-2025-66034

ubuntu
Calendar Grey December 9, 2025
Dist Ubuntu Esm H88
Several critical security issues in fontTools for Ubuntu users require immediate updates for protection against threats.
Several security issues were fixed in fontTools.

Summary

Several security issues were fixed in fontTools.

Software Description:

- fonttools: a library for manipulating fonts, written in Python

Details:

It was discovered that the subsetting module of fontTools was vulnerable to

an XML External Entity (XEE) attack. An unauthenticated remote attacker

could possibly use this issue to include arbitrary files from the file

system or make web requests from the host system. This issue only affected

Ubuntu 22.04 LTS. (CVE-2023-45139)

It was discovered that fontTools was vulnerable to path traversal attacks.

If a user or automated system were tricked into extracting a specially

crafted .designspace file, an attacker could possibly use this issue to

write arbitrary files outside the target directory, resulting in remote

code execution. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.04

and Ubuntu 25.10. (CVE-2025-66034)

Topics%20covered

Topics Covered

security advisory remote code execution Ubuntu important path traversal fonttools

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
  fonttools                       4.55.3-2ubuntu0.25.10.1
  python3-fonttools               4.55.3-2ubuntu0.25.10.1

Ubuntu 25.04
  fonttools                       4.55.3-2ubuntu0.25.04.1
  python3-fonttools               4.55.3-2ubuntu0.25.04.1

Ubuntu 24.04 LTS
  fonttools                       4.46.0-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  python3-fonttools               4.46.0-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 22.04 LTS
  fonttools                       4.29.1-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  python3-fonttools               4.29.1-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-7917-1

CVE-2023-45139, CVE-2025-66034

Severity
important
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-7917-1

Topics%20covered

Topics Covered

security advisory remote code execution Ubuntu important path traversal fonttools

Package Information

https://launchpad.net/ubuntu/+source/fonttools/4.55.3-2ubuntu0.25.10.1
https://launchpad.net/ubuntu/+source/fonttools/4.55.3-2ubuntu0.25.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here