Heap-Based Buffer Over-Read in FontForge by The Foundry
CVE-2017-11572

7.8HIGH

Key Information:

Vendor

Fontforge

Status
Fontforge
Vendor
CVE Published:
23 July 2017

What is CVE-2017-11572?

FontForge 20161012 is susceptible to a heap-based buffer over-read in the readcfftopdicts function (located in parsettf.c). This vulnerability can be exploited by an attacker through a specially crafted OpenTypeFont (otf) file, potentially leading to Denial of Service (DoS) or arbitrary code execution. Mitigation strategies involve updating FontForge to a patched version to safeguard against this security risk.

References

http://www.debian.org/security/2017/dsa-3958
vendor-advisoryx_refsource_DEBIAN
https://github.com/fontforge/fontforge/issues/3092
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.