Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-5395: An out-of-bounds write was discovered in fontforge while parsing SFD files containing very large LayerCount tokens. The flaw allows an attacker to overwrite data before a buffer allocated on the heap, thus causing the application to crash or execute arbitrary code. 1790041: CVE-2020-5395 fontforge: out-of-bounds write in SFD_GetFontMetaData function in sfd.c
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | fontforge | 0:20120731b-13.amzn2 |
| Amazon Linux · 2 | fontforge-debuginfo | 0:20120731b-13.amzn2 |
| Amazon Linux · 2 | fontforge-devel | 0:20120731b-13.amzn2 |
Vulnerabilities 1
-
Unscored —
FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-5395.html