[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <927220f8-dc33-449a-80c6-6e1ab51b5594@oracle.com>
Date: Fri, 8 Mar 2024 11:06:35 -0800
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Vulnerabilties in FontTools & FontForge
https://www.canva.dev/blog/engineering/fonts-are-still-a-helvetica-of-a-problem/
is a detailed blog about vulnerabilities in some open source font handling software.
It discusses three new vulnerabilities in particular:
- CVE-2023-45139 in FontTools versions >=4.28.2, <4.43.0, fixed in 4.43.0
FontTools uses lxml to process SVG tables in OpenType fonts, and had
not disabled external entity expansion (which lmxl enables by default),
leading to an XML External Entity (XXE) vulnerability.
The project has issued it's own advisory for this at:
https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5
- CVE-2024-25081 & CVE-2024-25082 in FontForge, fixed in git repo
FontForge used the system() function to execute commands to unpack fonts
from archives, and the command line arguments it provides include both the
name of the archive and the name of a font file specified inside the archive,
leading to a classic command injection vulnerability if used to unpack a
specially-named or a specially-crafted archive file.
A patch to switch from system() to glib's g_spawn_sync() was merged
upstream on Feb. 6, but there don't seem to be any new releases yet:
https://github.com/fontforge/fontforge/pull/5367
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
