Moderate Command Injection Vulnerabilities in FontForge Package
Summary
RLSA-2024:4267: Moderate: fontforge security update. Affects fontforge versions < 0:20200314-6.el8_10. Fixed in 0:20200314-6.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FontForge is an open-source font editor that allows users to create and edit outline and bitmap fonts. It supports various font formats, including PostScript, TrueType, OpenType, and CID-keyed fonts. Despite its robust functionality, FontForge has been found to be vulnerable to command injection attacks, which can be exploited through crafted filenames and archives.
Vulnerability Detail
The vulnerabilities identified in FontForge are classified as command injection flaws. Specifically, CVE-2024-25081 allows attackers to execute arbitrary commands by manipulating filenames, while CVE-2024-25082 enables similar exploitation through crafted archives or compressed files. These vulnerabilities can lead to unauthorized access, data corruption, or system compromise, making it critical for users to address them promptly.
How To Fix
Minimum fixed version
0:20200314-6.el8_10
This is the first release that contains the fix.
sudo dnf update fontforgeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid opening untrusted files or archives with FontForge until the update is applied. Additionally, consider running FontForge in a controlled environment or sandbox to mitigate potential risks.
Conclusion
The command injection vulnerabilities in FontForge pose a significant risk to users, allowing potential attackers to execute arbitrary commands. It is essential to update to the latest patched version to mitigate these risks. Users are also encouraged to employ workarounds until they can apply the update.
See every vulnerability recorded for fontforge →
FAQ
Command injection is a security vulnerability that allows an attacker to execute arbitrary commands on a host operating system via a vulnerable application.
You can check your version of FontForge by running 'fontforge --version' in the terminal. If it is earlier than 0:20200314-6.el8_10, it is affected.
If an immediate update is not possible, refrain from using FontForge with untrusted files and consider using a sandboxed environment.
Detailed information about the vulnerabilities can be found on the CVE pages for CVE-2024-25081 and CVE-2024-25082.
Vulert monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json, providing real-time alerts without needing access to the code.
Related vulnerabilities
Recent vulnerabilities recorded for fontforge.
