FontForge vulnerabilities

The uiutil.c file in FontForge through version 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which may allow remote attackers to conduct argument-injection attacks via a crafted URL.

FontForge version 20161012 is vulnerable to a buffer over-read in getsid (parsettf.c), which may lead to DoS or code execution via a crafted otf file.

FontForge version 20161012 is vulnerable to a buffer over-read in the strnmatch function (char.c), which may lead to DoS or code execution via a crafted otf file.

FontForge version 20161012 is vulnerable to a heap-based buffer overflow in the readcffset function (parsettf.c), which may lead to DoS attacks or code execution via a crafted otf file.

FontForge version 20161012 is vulnerable to a buffer over-read in ValidatePostScriptFontName (parsettf.c), which may lead to DoS or code execution via a crafted otf file.

FontForge version 20161012 is vulnerable to a heap-based buffer over-read in the readcfftopdicts function (parsettf.c), which may lead to DoS or code execution via a crafted otf file.

FontForge version 20161012 is vulnerable to a stack-based buffer overflow in the addnibble function (parsettf.c), potentially leading to DoS or code execution via a crafted otf file.

FontForge version 20161012 is vulnerable to a buffer over-read in umodenc (parsettf.c), which may lead to DoS or code execution via a crafted otf file.

FontForge version 20161012 is vulnerable to a heap-based buffer over-read in readttfcopyrights (parsettf.c), potentially leading to DoS or code execution via a crafted otf file.

FontForge version 20161012 is vulnerable to a heap-based buffer over-read in PSCharStringToSplines (psread.c), which may lead to DoS or code execution via a crafted otf file.