CVE-2017-11574
HighSummary
FontForge version 20161012 is vulnerable to a heap-based buffer overflow in the readcffset function (parsettf.c), which may lead to DoS attacks or code execution via a crafted otf file.
Risk Assessment
This vulnerability could result in service disruption or allow an attacker to execute malicious code on the victim's system.
Recommendation
It is recommended to update FontForge to the latest version to mitigate this vulnerability and to monitor systems for suspicious otf files.
Other vulnerabilities in FontForge
See all- CVE-2017-17521High
The uiutil.c file in FontForge through version 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
- CVE-2017-11577High
FontForge version 20161012 is vulnerable to a buffer over-read in getsid (parsettf.c), which may lead to DoS or code execution via a crafted otf file.
- CVE-2017-11575High
FontForge version 20161012 is vulnerable to a buffer over-read in the strnmatch function (char.c), which may lead to DoS or code execution via a crafted otf file.
- CVE-2017-11573High
FontForge version 20161012 is vulnerable to a buffer over-read in ValidatePostScriptFontName (parsettf.c), which may lead to DoS or code execution via a crafted otf file.
- CVE-2017-11572High
FontForge version 20161012 is vulnerable to a heap-based buffer over-read in the readcfftopdicts function (parsettf.c), which may lead to DoS or code execution via a crafted otf file.
- CVE-2017-11571High
FontForge version 20161012 is vulnerable to a stack-based buffer overflow in the addnibble function (parsettf.c), potentially leading to DoS or code execution via a crafted otf file.
- CVE-2017-11570High
FontForge version 20161012 is vulnerable to a buffer over-read in umodenc (parsettf.c), which may lead to DoS or code execution via a crafted otf file.
- CVE-2017-11569High
FontForge version 20161012 is vulnerable to a heap-based buffer over-read in readttfcopyrights (parsettf.c), potentially leading to DoS or code execution via a crafted otf file.
- CVE-2017-11568High
FontForge version 20161012 is vulnerable to a heap-based buffer over-read in PSCharStringToSplines (psread.c), which may lead to DoS or code execution via a crafted otf file.
Original NVD description (English source)
FontForge 20161012 is vulnerable to a heap-based buffer overflow in readcffset (parsettf.c) resulting in DoS or code execution via a crafted otf file.