CVE-2017-11575
HighSummary
FontForge version 20161012 is vulnerable to a buffer over-read in the strnmatch function (char.c), which may lead to DoS or code execution via a crafted otf file.
Risk Assessment
This vulnerability could allow attackers to execute remote code or disrupt service, posing a significant threat to the organization.
Recommendation
It is recommended to update FontForge to the latest version to mitigate this vulnerability and to monitor systems for potential attacks.
Other vulnerabilities in FontForge
See all- CVE-2017-17521High
The uiutil.c file in FontForge through version 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.
- CVE-2017-11577High
FontForge version 20161012 is vulnerable to a buffer over-read in getsid (parsettf.c), which may lead to DoS or code execution via a crafted otf file.
- CVE-2017-11574High
FontForge version 20161012 is vulnerable to a heap-based buffer overflow in the readcffset function (parsettf.c), which may lead to DoS attacks or code execution via a crafted otf file.
- CVE-2017-11573High
FontForge version 20161012 is vulnerable to a buffer over-read in ValidatePostScriptFontName (parsettf.c), which may lead to DoS or code execution via a crafted otf file.
- CVE-2017-11572High
FontForge version 20161012 is vulnerable to a heap-based buffer over-read in the readcfftopdicts function (parsettf.c), which may lead to DoS or code execution via a crafted otf file.
- CVE-2017-11571High
FontForge version 20161012 is vulnerable to a stack-based buffer overflow in the addnibble function (parsettf.c), potentially leading to DoS or code execution via a crafted otf file.
- CVE-2017-11570High
FontForge version 20161012 is vulnerable to a buffer over-read in umodenc (parsettf.c), which may lead to DoS or code execution via a crafted otf file.
- CVE-2017-11569High
FontForge version 20161012 is vulnerable to a heap-based buffer over-read in readttfcopyrights (parsettf.c), potentially leading to DoS or code execution via a crafted otf file.
- CVE-2017-11568High
FontForge version 20161012 is vulnerable to a heap-based buffer over-read in PSCharStringToSplines (psread.c), which may lead to DoS or code execution via a crafted otf file.
Original NVD description (English source)
FontForge 20161012 is vulnerable to a buffer over-read in strnmatch (char.c) resulting in DoS or code execution via a crafted otf file, related to a call from the readttfcopyrights function in parsettf.c.