Skip to content
OpenAdvisories
Medium ALSA-2024:9439 2 CVEs

Moderate: fontforge security update

Published Nov 12, 2024 · Updated Oct 29, 2026

Summary

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.

Security Fix(es):

* fontforge: command injection via crafted archives or compressed files (CVE-2024-25082)
* fontforge: command injection via crafted filenames (CVE-2024-25081)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 1

ReleasePackageFixed in
AlmaLinux · 9 fontforge 20201107-6.el9

Vulnerabilities 2

References

  • report
    https://access.redhat.com/security/cve/CVE-2024-25081
  • report
    https://access.redhat.com/security/cve/CVE-2024-25082
  • report
    https://bugzilla.redhat.com/2266180
  • report
    https://bugzilla.redhat.com/2266181
  • advisory
    https://errata.almalinux.org/9/ALSA-2024-9439.html