Heap-Based Buffer Over-Read Vulnerability in FontForge Software by FontForge
CVE-2017-11569

7.8HIGH

Key Information:

Vendor

Fontforge

Status
Fontforge
Vendor
CVE Published:
23 July 2017

What is CVE-2017-11569?

FontForge 20161012 is susceptible to a heap-based buffer over-read in the 'readttfcopyrights' function within 'parsettf.c'. This vulnerability can be exploited by an attacker using a crafted OpenType font (OTF) file, potentially leading to denial of service conditions or execution of arbitrary code.

References

http://www.debian.org/security/2017/dsa-3958
vendor-advisoryx_refsource_DEBIAN
https://github.com/fontforge/fontforge/issues/3093
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.