Medium DLA-3754-1 4 CVEs

fontforge - security update

Published Mar 8, 2024 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 10	fontforge	1:20170731~dfsg-1+deb10u1

Vulnerabilities 4

Medium 6.5

CVE-2024-25082 Public exploit

Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.

fontforge fontforge fontforge-doc Debian Ubuntu Wolfi

Feb 26, 2024
Medium 4.2

CVE-2024-25081 Public exploit

Splinefont in FontForge through 20230101 allows command injection via crafted filenames.

fontforge fontforge fontforge-doc Debian Ubuntu Wolfi

Feb 26, 2024
Unscored —

CVE-2020-5395

FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c.

fontforge fontforge Debian Ubuntu

Jan 3, 2020
Unscored —

CVE-2020-5496

FontForge 20190801 has a heap-based buffer overflow in the Type2NotDefSplines() function in splinesave.c.

fontforge fontforge Debian Ubuntu

Jan 3, 2020