Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 8 Mar 2024 11:06:35 -0800
From: Alan Coopersmith <>
Subject: Vulnerabilties in FontTools & FontForge
is a detailed blog about vulnerabilities in some open source font handling software.

It discusses three new vulnerabilities in particular:

- CVE-2023-45139 in FontTools versions >=4.28.2, <4.43.0, fixed in 4.43.0

    FontTools uses lxml to process SVG tables in OpenType fonts, and had
    not disabled external entity expansion (which lmxl enables by default),
    leading to an XML External Entity (XXE) vulnerability.

    The project has issued it's own advisory for this at:

- CVE-2024-25081 & CVE-2024-25082 in FontForge, fixed in git repo

    FontForge used the system() function to execute commands to unpack fonts
    from archives, and the command line arguments it provides include both the
    name of the archive and the name of a font file specified inside the archive,
    leading to a classic command injection vulnerability if used to unpack a
    specially-named or a specially-crafted archive file.

    A patch to switch from system() to glib's g_spawn_sync() was merged
    upstream on Feb. 6, but there don't seem to be any new releases yet:

         -Alan Coopersmith-       
          Oracle Solaris Engineering -

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.