Argument Injection Vulnerability in FontForge by FontForge
CVE-2017-17521

8.8HIGH

Key Information:

Vendor

Fontforge

Status
Fontforge
Vendor
CVE Published:
14 December 2017

What is CVE-2017-17521?

The vulnerability in FontForge allows remote attackers to exploit the lack of string validation in the 'BROWSER' environment variable. By crafting a malicious URL, an attacker can conduct argument-injection attacks. This could lead to unauthorized command execution, making it crucial to secure affected versions of FontForge against such risks.

References

https://security-tracker.debian.org/tracker/CVE-2017-17521
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.