6.5

CVE-2024-25082

Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fontforge ≫ Fontforge Version <= 20230101
Debian ≫ Debian Linux Version10.0
Fedoraproject ≫ Fedora Version40
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.87% 0.766
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 6.5 3.9 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

https://lists.debian.org/debian-lts-announce/2024/03/msg00007.html
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2024/03/08/2
Third Party Advisory
Mailing List
https://fontforge.org/en-US/downloads/
Product
https://github.com/fontforge/fontforge/pull/5367
Patch
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCH22HIO2C6M4BZWF5EYIWVFBXL5BQAH/
Mailing List
Issue Tracking
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCH22HIO2C6M4BZWF5EYIWVFBXL5BQAH/