Splinefont in FontForge through 20230101 allows command injection via crafted filenames.
CVSS Details
- CVSS 3.1 Base Score: 4.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade fontforge | Jul 4, 2024 | Feb 26, 2024 |
| Amazon Linux Ami 2 | — | Upgrade fontforgeUpgrade fontforge-develUpgrade fontforge-debuginfo | Mar 19, 2024 | Feb 26, 2024 |
| Amazon_linux_2023 | — | Upgrade fontforge-develUpgrade fontforge-docUpgrade fontforge-debugsourceUpgrade fontforge-debuginfoUpgrade fontforge | Feb 17, 2025 | Feb 26, 2024 |
| Debian | — | Upgrade fontforge | Mar 11, 2024 | Feb 26, 2024 |
| Gentoo Linux | — | Upgrade media-gfx/fontforge. | Aug 7, 2025 | Aug 6, 2025 |
| Oracle_linux | — | Upgrade fontforge | Nov 21, 2024 | Feb 26, 2024 |
| Redhat_linux | — | Upgrade fontforgeUpgrade fontforge-debugsourceNo solution existsUpgrade fontforge-debuginfo | Jul 3, 2024 | Feb 26, 2024 |
| Rocky_linux | — | Upgrade fontforge-debuginfoUpgrade fontforgeUpgrade fontforge-debugsource | Mar 18, 2025 | Feb 26, 2024 |
| Suse | — | Upgrade fontforgeUpgrade fontforge-docUpgrade fontforge-devel | Mar 14, 2024 | Feb 26, 2024 |
| Ubuntu | — | Upgrade fontforgeUpgrade python3-fontforgeUpgrade fontforge (Ubuntu Pro)Upgrade python-fontforge (Ubuntu Pro) | Jul 3, 2024 | Feb 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub