Fontforge
by Fontforge
Source repositories
CVEs (33)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-11573 | Hig | 0.51 | 7.8 | 0.01 | Jul 23, 2017 | FontForge 20161012 is vulnerable to a buffer over-read in ValidatePostScriptFontName (parsettf.c) resulting in DoS or code execution via a crafted otf file. | ||
| CVE-2017-11572 | Hig | 0.51 | 7.8 | 0.01 | Jul 23, 2017 | FontForge 20161012 is vulnerable to a heap-based buffer over-read in readcfftopdicts (parsettf.c) resulting in DoS or code execution via a crafted otf file. | ||
| CVE-2017-11571 | Hig | 0.51 | 7.8 | 0.01 | Jul 23, 2017 | FontForge 20161012 is vulnerable to a stack-based buffer overflow in addnibble (parsettf.c) resulting in DoS or code execution via a crafted otf file. | ||
| CVE-2017-11570 | Hig | 0.51 | 7.8 | 0.01 | Jul 23, 2017 | FontForge 20161012 is vulnerable to a buffer over-read in umodenc (parsettf.c) resulting in DoS or code execution via a crafted otf file. | ||
| CVE-2017-11569 | Hig | 0.51 | 7.8 | 0.01 | Jul 23, 2017 | FontForge 20161012 is vulnerable to a heap-based buffer over-read in readttfcopyrights (parsettf.c) resulting in DoS or code execution via a crafted otf file. | ||
| CVE-2017-11568 | Hig | 0.51 | 7.8 | 0.01 | Jul 23, 2017 | FontForge 20161012 is vulnerable to a heap-based buffer over-read in PSCharStringToSplines (psread.c) resulting in DoS or code execution via a crafted otf file. | ||
| CVE-2017-11576 | Med | 0.36 | 5.5 | 0.01 | Jul 23, 2017 | FontForge 20161012 does not ensure a positive size in a weight vector memcpy call in readcfftopdict (parsettf.c) resulting in DoS via a crafted otf file. | ||
| CVE-2010-4259 | 0.04 | — | 0.11 | Dec 7, 2010 | Stack-based buffer overflow in FontForge 20100501 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long CHARSET_REGISTRY header in a BDF font file. | |||
| CVE-2025-50951 | Med | 0.00 | 6.5 | 0.00 | Oct 23, 2025 | FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c. | ||
| CVE-2025-50949 | Med | 0.00 | 6.5 | 0.00 | Oct 23, 2025 | FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8. | ||
| CVE-2024-25082 | Med | 0.00 | 6.5 | 0.02 | Feb 26, 2024 | Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files. | ||
| CVE-2024-25081 | Med | 0.00 | 4.2 | 0.01 | Feb 26, 2024 | Splinefont in FontForge through 20230101 allows command injection via crafted filenames. | ||
| CVE-2019-15785 | Cri | 0.00 | 9.8 | 0.03 | Aug 29, 2019 | FontForge 20190813 through 20190820 has a buffer overflow in PrefsUI_LoadPrefs in prefs.c. |
- risk 0.51cvss 7.8epss 0.01
FontForge 20161012 is vulnerable to a buffer over-read in ValidatePostScriptFontName (parsettf.c) resulting in DoS or code execution via a crafted otf file.
- risk 0.51cvss 7.8epss 0.01
FontForge 20161012 is vulnerable to a heap-based buffer over-read in readcfftopdicts (parsettf.c) resulting in DoS or code execution via a crafted otf file.
- risk 0.51cvss 7.8epss 0.01
FontForge 20161012 is vulnerable to a stack-based buffer overflow in addnibble (parsettf.c) resulting in DoS or code execution via a crafted otf file.
- risk 0.51cvss 7.8epss 0.01
FontForge 20161012 is vulnerable to a buffer over-read in umodenc (parsettf.c) resulting in DoS or code execution via a crafted otf file.
- risk 0.51cvss 7.8epss 0.01
FontForge 20161012 is vulnerable to a heap-based buffer over-read in readttfcopyrights (parsettf.c) resulting in DoS or code execution via a crafted otf file.
- risk 0.51cvss 7.8epss 0.01
FontForge 20161012 is vulnerable to a heap-based buffer over-read in PSCharStringToSplines (psread.c) resulting in DoS or code execution via a crafted otf file.
- risk 0.36cvss 5.5epss 0.01
FontForge 20161012 does not ensure a positive size in a weight vector memcpy call in readcfftopdict (parsettf.c) resulting in DoS via a crafted otf file.
- CVE-2010-4259Dec 7, 2010risk 0.04cvss —epss 0.11
Stack-based buffer overflow in FontForge 20100501 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long CHARSET_REGISTRY header in a BDF font file.
- risk 0.00cvss 6.5epss 0.00
FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c.
- risk 0.00cvss 6.5epss 0.00
FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8.
- risk 0.00cvss 6.5epss 0.02
Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.
- risk 0.00cvss 4.2epss 0.01
Splinefont in FontForge through 20230101 allows command injection via crafted filenames.
- risk 0.00cvss 9.8epss 0.03
FontForge 20190813 through 20190820 has a buffer overflow in PrefsUI_LoadPrefs in prefs.c.
Page 2 of 2