CVE-2024-25082: Command Injection
Published Feb 26, 2024
·Updated
Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.
Affected Software
9 affected componentsFixes available
ubuntu/fontforge<1:20170731~dfsg-1ubuntu0.1~
1:20170731~dfsg-1ubuntu0.1~
ubuntu/fontforge<1:20190801~dfsg-4ubuntu0.1
1:20190801~dfsg-4ubuntu0.1
ubuntu/fontforge<1:20201107~dfsg-4+
1:20201107~dfsg-4+
ubuntu/fontforge<1:20230101~dfsg-1ubuntu0.1
1:20230101~dfsg-1ubuntu0.1
ubuntu/fontforge<20120731.
20120731.
debian/fontforge
1:20201107~dfsg-4+deb11u11:20230101~dfsg-1.1~deb12u11:20230101~dfsg-3
FontForge FontForge<=20230101
Debian Debian Linux=10.0
Fedoraproject Fedora=40
Remediation
Patch Available
Event History
Feb 26, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:27 PM
Description
Data Sourced
via Red Hat·09:38 PM
DescriptionSeverityAffected Software
Mar 8, 2024
News Published
via The Register·03:57 AM
News Published
via The Register·04:00 AM
Jul 1, 2024
Data Sourced
via Launchpad·10:48 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2024-25082?
CVE-2024-25082 has a high severity due to the potential for command injection.
2
How do I fix CVE-2024-25082?
To fix CVE-2024-25082, upgrade to a patched version of FontForge specified for your distribution.
3
What versions of FontForge are affected by CVE-2024-25082?
Versions of FontForge prior to 20230101 on various Ubuntu and Debian distributions are affected by CVE-2024-25082.
4
What types of files can trigger the vulnerability in CVE-2024-25082?
CVE-2024-25082 can be triggered via crafted archives or compressed files.
5
Is CVE-2024-25082 exploit-related?
Yes, CVE-2024-25082 is related to a vulnerability that allows attackers to execute arbitrary commands through exploited files.