Buffer Over-read Vulnerability in FontForge by FontForge
CVE-2017-11570

7.8HIGH

Key Information:

Vendor

Fontforge

Status
Fontforge
Vendor
CVE Published:
23 July 2017

What is CVE-2017-11570?

A buffer over-read vulnerability exists in FontForge version 20161012 within the umodenc function (parsettf.c). This flaw allows an attacker to exploit the application through specially crafted OpenType Font (OTF) files, potentially leading to a denial of service or execution of arbitrary code. Proper input validation and sanitization are crucial to mitigate the risk posed by this vulnerability.

References

https://github.com/fontforge/fontforge/issues/3097
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.