Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -5 articles for you...
89
security advisoryfedoraupdateUbuntu 24: glyphutils Severe RCE Unrestricted File Access 2025-abcd1234ef
Update to 17.0.0 version (#2412270) Update fonttools 4.61.0. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-58e2bb0f1e 2025-12-20 01:18:41.356091+00:00 -------------------------------------------------------------------------------- Name : fonttools Product : Fedora 42 Version : 4.61.0 Release : 1.fc42 URL : https://github.com/fonttools/fonttools/ Summary : Tools to manipulate font files Description : fontTools is a library for manipulating fonts, written in Python. The project includes the TTX tool, that can convert TrueType and OpenType fonts to and from an XML text format, which is also called TTX. It supports TrueType, OpenType, AFM and to an extent Type 1 and some Mac-specific formats. -------------------------------------------------------------------------------- Update Information: Update to 17.0.0 version (#2412270) Update fonttools 4.61.0 -------------------------------------------------------------------------------- ChangeLog: * Tue Dec 9 2025 Parag Nemade - 4.61.0-1 - Update to 4.61.0 version (#2419183) * Thu Oct 2 2025 Parag Nemade - 4.60.1-1 - Update to 4.60.1 version (#2400374) * Fri Sep 19 2025 Python Maint - 4.60.0-2 - Rebuilt for Python 3.14.0rc3 bytecode * Wed Sep 17 2025 Parag Nemade - 4.60.0-1 - Update to 4.60.0 version (#2396057) * Thu Aug 28 2025 Parag Nemade - 4.59.2-1 - Update to 4.59.2 version (#2391330) * Fri Aug 15 2025 Python Maint - 4.59.1-2 - Rebuilt for Python 3.14.0rc2 bytecode * Fri Aug 15 2025 Parag Nemade - 4.59.1-1 - Update to 4.59.1 version (#2388618) * Wed Jul 23 2025 Fedora Release Engineering - 4.59.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Fri Jul 18 2025 Parag Nemade - 4.59.0-2 - Skip failing test test_ttcompile_timestamp_calcs * Wed Jul 16 2025 Parag Nemade - 4.59.0-1 - Update to 4.59.0 version (#2381317) * Fri Jul 4 2025 Parag Nemade - 4.58.5-1 - Update to4.58.5 version (#2376209) * Mon Jun 16 2025 Benjamin A. Beasley - 4.58.4-1 - Update to 4.58.4 version (#2370864) - No longer bootstrapping (build with tests enabled) * Sun Jun 15 2025 Python Maint - 4.58.1-3 - Bootstrap for Python 3.14 * Tue Jun 3 2025 Python Maint - 4.58.1-2 - Bootstrap for Python 3.14 * Thu May 29 2025 Parag Nemade - 4.58.1-1 - Update to 4.58.1 version (#2368984) * Mon May 12 2025 Parag Nemade - 4.58.0-1 - Update to 4.58.0 version (#2365442) * Fri Apr 4 2025 Parag Nemade - 4.57.0-1 - Update to 4.57.0 version (#2357231) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2421330 - CVE-2025-66034 fonttools: fontTools: Arbitrary file write leading to remote code execution via malicious .designspace file [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2421330 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-58e2bb0f1e' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Dec 20, 2025
•Critical
Fedora
172
security advisoryremote code executionUbuntuUbuntu 22.04 LTS: fontTools Important Path Traversal Risk CVE-2025-66034
Several security issues were fixed in fontTools.. ========================================================================== Ubuntu Security Notice USN-7917-1 December 09, 2025 fonttools vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 - Ubuntu 25.04 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Several security issues were fixed in fontTools. Software Description: - fonttools: a library for manipulating fonts, written in Python Details: It was discovered that the subsetting module of fontTools was vulnerable to an XML External Entity (XEE) attack. An unauthenticated remote attacker could possibly use this issue to include arbitrary files from the file system or make web requests from the host system. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-45139) It was discovered that fontTools was vulnerable to path traversal attacks. If a user or automated system were tricked into extracting a specially crafted .designspace file, an attacker could possibly use this issue to write arbitrary files outside the target directory, resulting in remote code execution. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.04 and Ubuntu 25.10. (CVE-2025-66034) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 fonttools 4.55.3-2ubuntu0.25.10.1 python3-fonttools 4.55.3-2ubuntu0.25.10.1 Ubuntu 25.04 fonttools 4.55.3-2ubuntu0.25.04.1 python3-fonttools 4.55.3-2ubuntu0.25.04.1 Ubuntu 24.04 LTS fonttools 4.46.0-1ubuntu0.1~esm1 Available with Ubuntu Pro python3-fonttools 4.46.0-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 22.04 LTS fonttools 4.29.1-2ubuntu0.1~esm1 Available with Ubuntu Pro python3-fonttools 4.29.1-2ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7917-1 CVE-2023-45139, CVE-2025-66034 Package Information: https://launchpad.net/ubuntu/+source/fonttools/4.55.3-2ubuntu0.25.10.1 https://launchpad.net/ubuntu/+source/fonttools/4.55.3-2ubuntu0.25.04.1 . Several critical security issues in fontTools for Ubuntu users require immediate updates for protection against threats.. Ubuntu fontTools update security. . Severity: Important. LinuxSecurity.com Team
Dec 09, 2025
•Important
Ubuntu
203
security advisorycriticalarbitrary accessMageia 9: 2024-0060 Critical: FontTools XXE Injection Attack
As of fonttools> =4.28.2 the subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem . MGASA-2024-0060 - Updated fonttools packages fix security vulnerabilities Publication date: 14 Mar 2024 URL: https://advisories.mageia.org/MGASA-2024-0060.html Type: security Affected Mageia releases: 9 CVE: CVE-2023-45139 As of fonttools> =4.28.2 the subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. References: - https://bugs.mageia.org/show_bug.cgi?id=32955 - https://www.openwall.com/lists/oss-security/2024/03/08/2 - https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5 - https://www.cve.org/CVERecord?id=CVE-2023-45139 SRPMS: - 9/core/fonttools-4.38.0-2.1.mga9 . Revised fonttools libraries in Mageia address security concerns linked to XXE vulnerability present in OT-SVG typefaces.. FontTools Security Update, Mageia Security Advisory, XXE Vulnerability. . Severity: Critical. LinuxSecurity.com Team
Mar 14, 2024
•Critical
Mageia
89
security advisorycritical issuefedoraFedora 39: 2024-6d1d9f70d2 critical: fonttools XML Injection
Security fix for CVE-2023-45139. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-6d1d9f70d2 2024-01-25 00:38:48.210927 -------------------------------------------------------------------------------- Name : fonttools Product : Fedora 39 Version : 4.43.1 Release : 1.fc39 URL : https://github.com/fonttools/fonttools/ Summary : Tools to manipulate font files Description : fontTools is a library for manipulating fonts, written in Python. The project includes the TTX tool, that can convert TrueType and OpenType fonts to and from an XML text format, which is also called TTX. It supports TrueType, OpenType, AFM and to an extent Type 1 and some Mac-specific formats. -------------------------------------------------------------------------------- Update Information: Security fix for CVE-2023-45139 -------------------------------------------------------------------------------- ChangeLog: * Sun Oct 8 2023 Parag Nemade - 4.43.1-1 - Update to 4.43.1 version (#2241574) * Tue Aug 22 2023 Parag Nemade - 4.42.1-1 - Update to 4.42.1 version (#2232931) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2257808 - CVE-2023-45139 fonttools: XML External Entity Injection (XXE) Vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=2257808 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-6d1d9f70d2' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jan 25, 2024
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!