rpm package
almalinux/fontforge
pkg:rpm/almalinux/fontforge
Vulnerabilities (8)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-15279 | — | < 20201107-7.el9_7 | 20201107-7.el9_7 | Dec 31, 2025 | FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the ta | ||
| CVE-2025-15275 | — | < 20201107-7.el9_7 | 20201107-7.el9_7 | Dec 31, 2025 | FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target mu | ||
| CVE-2025-15270 | — | < 20201107-8.el9_7 | 20201107-8.el9_7 | Dec 31, 2025 | FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the t | ||
| CVE-2025-15269 | — | < 20201107-7.el9_7 | 20201107-7.el9_7 | Dec 31, 2025 | FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a m | ||
| CVE-2024-25082 | — | < 20200314-6.el8_10 | 20200314-6.el8_10 | Feb 26, 2024 | Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files. | ||
| CVE-2024-25081 | — | < 20200314-6.el8_10 | 20200314-6.el8_10 | Feb 26, 2024 | Splinefont in FontForge through 20230101 allows command injection via crafted filenames. | ||
| CVE-2020-25690 | — | < 20170731-15.el8 | 20170731-15.el8 | Feb 23, 2021 | An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. Th | ||
| CVE-2020-5395 | — | < 20170731-15.el8 | 20170731-15.el8 | Jan 3, 2020 | FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c. |
- CVE-2025-15279Dec 31, 2025affected < 20201107-7.el9_7fixed 20201107-7.el9_7
FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the ta
- CVE-2025-15275Dec 31, 2025affected < 20201107-7.el9_7fixed 20201107-7.el9_7
FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target mu
- CVE-2025-15270Dec 31, 2025affected < 20201107-8.el9_7fixed 20201107-8.el9_7
FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the t
- CVE-2025-15269Dec 31, 2025affected < 20201107-7.el9_7fixed 20201107-7.el9_7
FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to exploit this vulnerability in that the target must visit a m
- CVE-2024-25082Feb 26, 2024affected < 20200314-6.el8_10fixed 20200314-6.el8_10
Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.
- CVE-2024-25081Feb 26, 2024affected < 20200314-6.el8_10fixed 20200314-6.el8_10
Splinefont in FontForge through 20230101 allows command injection via crafted filenames.
- CVE-2020-25690Feb 23, 2021affected < 20170731-15.el8fixed 20170731-15.el8
An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. Th
- CVE-2020-5395Jan 3, 2020affected < 20170731-15.el8fixed 20170731-15.el8
FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c.