Moderate Security Update for FontForge: Command Injection Vulnerabilities
Summary
ALSA-2024:9439: Moderate: fontforge security update. Affects fontforge versions < 20201107-6.el9. Fixed in 20201107-6.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FontForge is a versatile font editor that allows users to create and edit outline and bitmap fonts. It supports various font formats, including PostScript, TrueType, OpenType, and CID-keyed fonts. Despite its powerful capabilities, FontForge has been found vulnerable to command injection attacks, which can be exploited through crafted archives or filenames, potentially compromising system security.
Vulnerability Detail
The vulnerabilities identified in FontForge are classified as command injection flaws. Specifically, CVE-2024-25082 allows attackers to execute arbitrary commands via crafted archives or compressed files, while CVE-2024-25081 enables command injection through specially crafted filenames. These vulnerabilities could lead to unauthorized access or control over the affected system, posing significant risks to users and their data.
How To Fix
Minimum fixed version
20201107-6.el9
This is the first release that contains the fix.
sudo dnf update fontforgeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to avoid opening untrusted archives or files with FontForge until the package is updated. Implementing strict file validation and sanitization can also help mitigate the risk of command injection.
Conclusion
The recent security update for FontForge addresses critical command injection vulnerabilities that could compromise system integrity. Users are strongly encouraged to update to the latest version to safeguard their systems against potential attacks.
See every vulnerability recorded for fontforge →
FAQ
FontForge is an open-source font editor that allows users to create and modify various font types, including TrueType and OpenType.
Command injection vulnerabilities allow attackers to execute arbitrary commands on a host operating system through a vulnerable application.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check for vulnerabilities without needing to sign up.
If an immediate update is not possible, refrain from opening untrusted files and consider implementing additional security measures to validate file inputs.
For detailed information about the vulnerabilities, including CVSS scores and acknowledgments, refer to the CVE pages for CVE-2024-25081 and CVE-2024-25082.
Related vulnerabilities
Recent vulnerabilities recorded for fontforge.
