An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade fontforge | May 4, 2022 | Feb 23, 2021 |
| Redhat_linux | — | Upgrade fontforge-debuginfoUpgrade fontforgeUpgrade fontforge-debugsource | Dec 15, 2023 | Feb 23, 2021 |
| Suse | — | Upgrade fontforge-docUpgrade fontforgeUpgrade fontforge-devel | Dec 1, 2020 | Dec 1, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub