Fluid Attacks Database

Description

Splinefont in FontForge through 20230101 allows command injection via crafted filenames.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 14	fontforge	>=0 <1:20230101~dfsg-1.1	1:20230101~dfsg-1.1
debian 11	fontforge	=1:20201107~dfsg-4 \|\| >=0 <1:20201107~dfsg-4+deb11u1	1:20201107~dfsg-4+deb11u1
debian 12	fontforge	=1:20230101~dfsg-1 \|\| >=0 <1:20230101~dfsg-1.1~deb12u1	1:20230101~dfsg-1.1~deb12u1
debian 13	fontforge	>=0 <1:20230101~dfsg-1.1	1:20230101~dfsg-1.1
rpm rhel6	fontforge	-	-
rpm rhel9.4	fontforge	<0:20201107-6.el9_4	0:20201107-6.el9_4
rpm rhel8	fontforge	<0:20200314-6.el8_10	0:20200314-6.el8_10
rpm rhel9	fontforge	<0:20201107-6.el9	0:20201107-6.el9
rpm rhel7	fontforge	-	-

Aliases

References

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.