CVE-2017-17521 — Injection in Fontforge

CWE-74 — InjectionCWE-20 — Improper Input Validation10 documents6 sources
Severity
8.8HIGHNVD
EPSS
0.4%
top 41.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
FontforgeMensis Project MensisDebian Fontforge
Timeline
PublishedDec 14
Latest updateMay 14

Description

uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17534.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶NVDfontforge/fontforge20170731
▶NVDmensis_project/mensis0.0.080507

🔴Vulnerability Details

4
GHSA
GHSA-2vx5-c4h9-r3pg: uiutil↗2022-05-14
▶
GHSA
GHSA-8vv4-vqx2-f85v: uiutil↗2022-05-13
▶
OSV
CVE-2017-17521: uiutil↗2017-12-14
▶
OSV
CVE-2017-17534: uiutil↗2017-12-14
▶

📋Vendor Advisories

2
Red Hat
fontforge: Command injetion in help function uiutil.c↗2017-12-14
▶
Debian
CVE-2017-17521: fontforge - uiutil.c in FontForge through 20170731 does not validate strings before launchin...↗2017
▶

💬Community

2
Bugzilla
CVE-2017-17521 fontforge: Command injetion in help function uiutil.c↗2017-12-14
▶
Bugzilla
CVE-2017-17521 fontforge: Command injetion in help function uiutil.c [fedora-all]↗2017-12-14
▶
CVE-2017-17521 — Injection in Fontforge | cvebase