Fontforge CVE-2024-25081

MEDIUM

Command Injection (CWE-77)

2024-02-26 cve@mitre.org

Command Injection Fontforge Debian Linux Fedora

4.2

CVSS 3.1 · Vendor: mitre

Share

Severity by source

Vendor (mitre) PRIMARY

4.2 MEDIUM

AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

1

CVE Published

Feb 26, 2024 - 16:27 cve.org

MEDIUM 4.2

DescriptionCVE.org

Splinefont in FontForge through 20230101 allows command injection via crafted filenames.

AnalysisAI

Splinefont in FontForge through 20230101 allows command injection via crafted filenames. Rated medium severity (CVSS 4.2).

Technical ContextAI

This vulnerability is classified as Command Injection (CWE-77), which allows attackers to inject arbitrary commands into system command execution. Splinefont in FontForge through 20230101 allows command injection via crafted filenames. Affected products include: Fontforge, Debian Debian Linux, Fedoraproject Fedora. Version information: through 20230101.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Use parameterized APIs, avoid shell execution, validate input with strict allowlists.

More in Fontforge

View all

CVE-2019-15785 CRITICAL Act Now POC

FontForge 20190813 through 20190820 has a buffer overflow in PrefsUI_LoadPrefs in prefs.c. Rated critical severity (CVSS

CVE-2020-5496 HIGH This Week POC

FontForge 20190801 has a heap-based buffer overflow in the Type2NotDefSplines() function in splinesave.c. Rated high sev

CVE-2020-5395 HIGH This Week POC

FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c. Rated high severity (CVSS 8.8), this vulnerabil

CVE-2017-17521 HIGH This Week

uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER e

CVE-2017-11574 HIGH This Week

FontForge 20161012 is vulnerable to a heap-based buffer overflow in readcffset (parsettf.c) resulting in DoS or code exe

CVE-2017-11569 HIGH This Week

FontForge 20161012 is vulnerable to a heap-based buffer over-read in readttfcopyrights (parsettf.c) resulting in DoS or

CVE-2017-11571 HIGH This Week

FontForge 20161012 is vulnerable to a stack-based buffer overflow in addnibble (parsettf.c) resulting in DoS or code exe

CVE-2017-11568 HIGH This Week

FontForge 20161012 is vulnerable to a heap-based buffer over-read in PSCharStringToSplines (psread.c) resulting in DoS o

CVE-2017-11577 HIGH This Week

FontForge 20161012 is vulnerable to a buffer over-read in getsid (parsettf.c) resulting in DoS or code execution via a c

CVE-2017-11575 HIGH This Week

FontForge 20161012 is vulnerable to a buffer over-read in strnmatch (char.c) resulting in DoS or code execution via a cr

CVE-2017-11573 HIGH This Week

FontForge 20161012 is vulnerable to a buffer over-read in ValidatePostScriptFontName (parsettf.c) resulting in DoS or co

CVE-2017-11572 HIGH This Week

FontForge 20161012 is vulnerable to a heap-based buffer over-read in readcfftopdicts (parsettf.c) resulting in DoS or co

Same weakness CWE-77 – Command Injection

View all

CVE-2024-21887 CRITICAL POC

CVE-2012-1823 CRITICAL POC

CVE-2016-1555 CRITICAL POC

CVE-2015-2051 HIGH POC

CVE-2017-6327 HIGH POC

CVE-2023-34960 CRITICAL POC

CVE-2023-37679 CRITICAL POC

CVE-2025-10035 CRITICAL POC

Same technique Command Injection

View all

CVE-2012-1823 CRITICAL POC

CVE-2016-1555 CRITICAL POC

CVE-2014-6271 CRITICAL POC

CVE-2015-2051 HIGH POC

CVE-2014-6278 HIGH POC

CVE-2017-6334 HIGH POC

CVE-2024-50603 CRITICAL POC

CVE-2025-64328 HIGH POC

Share

CVE-2024-25081 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy