Most recent entries from all

BREW-fonttools-CVE-2023-45139 — fonttools XML External Entity Injection (XXE) Vulnerability

2026-10-03T11:05:18.548410+00:00

Affected: Homebrew: fonttools

fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.

EUVD-2026-242660

2026-10-03T11:05:18.548467+00:00

EUVD-2026-242660

fkie_cve-2023-45139

2026-10-03T11:05:18.548483+00:00

GHSA-6673-4983-2vx5 — fonttools XML External Entity Injection (XXE) Vulnerability

2026-10-03T11:05:18.548509+00:00

Affected: PyPI: fonttools

### Summary

As of `fonttools>=4.28.2` the subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed.

This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system.

### PoC

The vulnerability can be reproduced following the bellow steps on a unix based system.

1. Build a OT-SVG font which includes a external entity in the SVG table which resolves a local file. In our testing we utilised `/etc/passwd` for our POC file to include and modified an existing subset integration test to build the POC font - see bellow.

```python

from string import ascii_letters from fontTools.fontBuilder import FontBuilder from fontTools.pens.ttGlyphPen import TTGlyphPen from fontTools.ttLib import newTable

XXE_SVG = """\ ]> """

def main(): # generate a random TTF font with an SVG table glyph_order = [".notdef"] + list(ascii_letters) pen = TTGlyphPen(glyphSet=None) pen.moveTo((0, 0)) pen.lineTo((0, 500)) pen.lineTo((500, 500)) pen.lineTo((500, 0)) pen.closePath() glyph = pen.glyph() glyphs =…

gsd-2023-45139

2026-10-03T11:05:18.548563+00:00

gsd-2023-45139

OESA-2024-1080 — python-fonttools security update

2026-10-03T11:05:18.548577+00:00

Affected: openEuler:22.03-LTS-SP3: python-fonttools

FontTools is a library for manipulating fonts, written in Python. The project includes the TTX tool, that can convert TrueType and OpenType fonts to and from an XML text format, which is also called TTX. It supports TrueType, OpenType, AFM and to an extent Type 1 and some Mac-specific formats. The project has an MIT open-source licence. Security Fix(es): fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.(CVE-2023-45139)

PYSEC-2026-1388 — fonttools XML External Entity Injection (XXE) Vulnerability

2026-10-03T11:05:18.548602+00:00

Affected: PyPI: fonttools

### Summary

This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system.

### PoC

The vulnerability can be reproduced following the bellow steps on a unix based system.

```python

from string import ascii_letters from fontTools.fontBuilder import FontBuilder from fontTools.pens.ttGlyphPen import TTGlyphPen from fontTools.ttLib import newTable

XXE_SVG = """\ ]> """

UBUNTU-CVE-2023-45139

2026-10-03T11:05:18.548646+00:00

Affected: Ubuntu:Pro:22.04:LTS: fonttools

WID-SEC-W-2024-3377 — Dell PowerProtect Data Domain: Mehrere Schwachstellen

2026-10-03T11:05:18.548666+00:00

Ein lokaler Angreifer kann mehrere Schwachstellen in Dell PowerProtect Data Domain ausnutzen, um seine Privilegien zu erhöhen, Informationen offenzulegen und um nicht näher beschriebene Auswirkungen zu erzielen.