CVE-2024-25082: Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.

PriorityP344medium6.5CVSS 3.1

AVNACLPRNUINSUCLILAN

EPSS

1.87%

77.0th percentile

Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	fontforge	< fontforge 1:20230101~dfsg-1.1~deb12u1 (bookworm)	fontforge 1:20230101~dfsg-1.1~deb12u1 (bookworm)
fedoraproject	fedora	—	—
fontforge	fontforge	<= 20230101	—
fontforge	fontforge	>= 0 < 1:20201107~dfsg-4+deb11u1	1:20201107~dfsg-4+deb11u1
fontforge	fontforge	>= 0 < 1:20230101~dfsg-1.1~deb12u1	1:20230101~dfsg-1.1~deb12u1
fontforge	fontforge	>= 0 < 1:20230101~dfsg-1.1	1:20230101~dfsg-1.1
fontforge	fontforge	>= 0 < 1:20230101~dfsg-1.1	1:20230101~dfsg-1.1
fontforge	fontforge	>= 0 < 1:20190801~dfsg-4ubuntu0.1	1:20190801~dfsg-4ubuntu0.1
fontforge	fontforge	>= 0 < 1:20201107~dfsg-4+deb11u1build0.22.04.1	1:20201107~dfsg-4+deb11u1build0.22.04.1
fontforge	fontforge	>= 0 < 20120731.b-7.1ubuntu0.1+esm1	20120731.b-7.1ubuntu0.1+esm1
fontforge	fontforge	>= 0 < 1:20170731~dfsg-1ubuntu0.1~esm1	1:20170731~dfsg-1ubuntu0.1~esm1

CVSS provenance

nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

osv6.5MEDIUM

vendor_debian6.5MEDIUM

vendor_redhat6.5MEDIUM

vendor_ubuntu4.2MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.