Most recent entries from all

ALSA-2024:4267 — Moderate: fontforge security update

Affected: AlmaLinux:8: fontforge

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.

Security Fix(es):

* fontforge: command injection via crafted filenames (CVE-2024-25081) * fontforge: command injection via crafted archives or compressed files (CVE-2024-25082)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-01608

EUVD-2026-259416

fkie_cve-2024-25082

Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.

GHSA-2j3h-j2q3-wxp3

Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.

gsd-2024-25082

OESA-2024-1228 — fontforge security update

Affected: openEuler:20.03-LTS-SP1: fontforge, openEuler:20.03-LTS-SP4: fontforge, openEuler:22.03-LTS: fontforge, openEuler:22.03-LTS-SP1: fontforge, openEuler:22.03-LTS-SP2: fontforge, openEuler:22.03-LTS-SP3: fontforge

FontForge (former PfaEdit) is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): Splinefont in FontForge through 20230101 allows command injection via crafted filenames.(CVE-2024-25081) Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.(CVE-2024-25082)

RHSA-2024:4267 — Red Hat Security Advisory: fontforge security update

fontforge: command injection via crafted filenames fontforge: command injection via crafted archives or compressed files

RHSA-2026:2566 — Red Hat Security Advisory: fontforge security update

fontforge: command injection via crafted filenames fontforge: command injection via crafted archives or compressed files fontforge: FontForge: Remote Code Execution via Use-After-Free in SFD file parsing fontforge: FontForge: Arbitrary code execution via SFD file parsing buffer overflow fontforge: FontForge: Remote Code Execution via heap-based buffer overflow in BMP file parsing

SUSE-SU-2024:0863-1 — Security update for fontforge

Security update for fontforge

UBUNTU-CVE-2024-25082

Affected: Ubuntu:Pro:16.04:LTS: fontforge, Ubuntu:Pro:18.04:LTS: fontforge, Ubuntu:20.04:LTS: fontforge, Ubuntu:22.04:LTS: fontforge

Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.

WID-SEC-W-2024-1512 — Red Hat Enterprise Linux (FontForge): Mehrere Schwachstellen

Ein lokaler Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux in der Komponente FontForge ausnutzen, um Informationen offenzulegen und Daten zu manipulieren.