Splinefont in FontForge through 20230101 allows command injection via crafted filenames.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2024:4267 advisory.

    * fontforge: command injection via crafted filenames (CVE-2024-25081)
    * fontforge: command injection via crafted archives or compressed files (CVE-2024-25082)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4267 advisory.

    FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including     PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed     fonts.

    Security Fix(es):

    * fontforge: command injection via crafted filenames (CVE-2024-25081)

    * fontforge: command injection via crafted archives or compressed files (CVE-2024-25082)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6856-1 advisory.

    It was discovered that FontForge incorrectly handled filenames. If a user or an automated system were     tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to     perform a command injection. (CVE-2024-25081)

    It was discovered that FontForge incorrectly handled archives and compressed files. If a user or an     automated system were tricked into opening a specially crafted input file, a remote attacker could     possibly use this issue to perform command injection. (CVE-2024-25082)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-e01ef71e64 advisory.

  - Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed     files. (CVE-2024-25082)

  - Splinefont in FontForge through 20230101 allows command injection via crafted filenames. (CVE-2024-25081)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-565 advisory.

  - Splinefont in FontForge through 20230101 allows command injection via crafted filenames. (CVE-2024-25081)

  - Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed     files. (CVE-2024-25082)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5641 advisory.

  - Splinefont in FontForge through 20230101 allows command injection via crafted filenames. (CVE-2024-25081)

  - Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed     files. (CVE-2024-25082)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of fontforge installed on the remote host is prior to 20120731b-13. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2495 advisory.

  - Splinefont in FontForge through 20230101 allows command injection via crafted filenames. (CVE-2024-25081)

  - Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed     files. (CVE-2024-25082)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0863-1 advisory.

  - Splinefont in FontForge through 20230101 allows command injection via crafted filenames. (CVE-2024-25081)

  - Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed     files. (CVE-2024-25082)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0864-1 advisory.

  - Splinefont in FontForge through 20230101 allows command injection via crafted filenames. (CVE-2024-25081)

  - Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed     files. (CVE-2024-25082)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3754 advisory.

  - FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c. (CVE-2020-5395)

  - FontForge 20190801 has a heap-based buffer overflow in the Type2NotDefSplines() function in splinesave.c.
    (CVE-2020-5496)

  - Splinefont in FontForge through 20230101 allows command injection via crafted filenames. (CVE-2024-25081)

  - Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed     files. (CVE-2024-25082)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
201543	AlmaLinux 8 : fontforge (ALSA-2024:4267)	Nessus	Alma Linux Local Security Checks	medium
201293	RHEL 8 : fontforge (RHSA-2024:4267)	Nessus	Red Hat Local Security Checks	medium
201109	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : FontForge vulnerabilities (USN-6856-1)	Nessus	Ubuntu Local Security Checks	medium
194508	Fedora 40 : fontforge (2024-e01ef71e64)	Nessus	Fedora Local Security Checks	high
192454	Amazon Linux 2023 : fontforge, fontforge-devel (ALAS2023-2024-565)	Nessus	Amazon Linux Local Security Checks	high
192271	Debian dsa-5641 : fontforge - security update	Nessus	Debian Local Security Checks	high
192215	Amazon Linux 2 : fontforge (ALAS-2024-2495)	Nessus	Amazon Linux Local Security Checks	high
192142	SUSE SLES12 Security Update : fontforge (SUSE-SU-2024:0863-1)	Nessus	SuSE Local Security Checks	high
192104	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : fontforge (SUSE-SU-2024:0864-1)	Nessus	SuSE Local Security Checks	high
191733	Debian dla-3754 : fontforge - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2024-25081

medium

Tenable Plugins

medium

medium

medium

high

high

high

high

high

high

high