Red Hat Security Advisory: fontforge security update

Fixed packages 3

Vulnerabilities 2

• Medium 6.5
  CVE-2024-25082 Public exploit

  Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.

  fontforge fontforge fontforge-doc Debian Ubuntu Wolfi
  Feb 26, 2024
• Medium 4.2
  CVE-2024-25081 Public exploit

  Splinefont in FontForge through 20230101 allows command injection via crafted filenames.

  fontforge fontforge fontforge-doc Debian Ubuntu Wolfi
  Feb 26, 2024

References

• article
  https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index
• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266180
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266181
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9439.json
• report
  https://access.redhat.com/security/cve/CVE-2024-25081
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-25081
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-25081
• article
  https://github.com/fontforge/fontforge/pull/5367
• report
  https://access.redhat.com/security/cve/CVE-2024-25082
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-25082
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-25082