CVE-2017-11571 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Fontforge

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121 — Stack-based Buffer Overflow9 documents7 sources

Severity

7.8HIGHNVD

EPSS

0.5%

top 33.43%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Fontforge Debian Fontforge

Timeline

PublishedJul 23

Latest updateMay 13

Description

FontForge 20161012 is vulnerable to a stack-based buffer overflow in addnibble (parsettf.c) resulting in DoS or code execution via a crafted otf file.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/fontforge< fontforge 1:20170731~dfsg-1 (bookworm)

▶Debianfontforge/fontforge< 1:20170731~dfsg-1+3

▶Ubuntufontforge/fontforge< 20120731.b-5ubuntu0.1

▶NVDfontforge/fontforge20161012

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

GHSA

GHSA-57jx-w3vh-gfcf: FontForge 20161012 is vulnerable to a stack-based buffer overflow in addnibble (parsettf↗2022-05-13

▶

OSV

fontforge vulnerabilities↗2017-09-04

▶

OSV

CVE-2017-11571: FontForge 20161012 is vulnerable to a stack-based buffer overflow in addnibble (parsettf↗2017-07-23

▶

📋Vendor Advisories

Ubuntu

FontForge vulnerabilities↗2017-09-04

▶

Red Hat

fontforge: Stack-buffer overflow in addnibble function↗2017-06-14

▶

Debian

CVE-2017-11571: fontforge - FontForge 20161012 is vulnerable to a stack-based buffer overflow in addnibble (...↗2017

▶

💬Community

Bugzilla

CVE-2017-11571 fontforge: Stack-buffer overflow in addnibble function↗2017-07-26

▶

Bugzilla

CVE-2017-11568 CVE-2017-11569 CVE-2017-11570 CVE-2017-11571 CVE-2017-11572 CVE-2017-11573 CVE-2017-11574 CVE-2017-11575 CVE-2017-11576 CVE-2017-11577 fontforge: various flaws [fedora-all]↗2017-07-26

▶