Out-of-Bounds Write Vulnerability in FontForge Software by Red Hat
CVE-2020-25690

8.8HIGH

Key Information:

Vendor

Fontforge

Status
Fontforge
Vendor
CVE Published:
23 February 2021

What is CVE-2020-25690?

An out-of-bounds write vulnerability was discovered in FontForge prior to version 20200314. This flaw arises during the parsing of SFD files containing specific LayerCount tokens, which can lead to memory manipulation on the heap. An attacker exploiting this vulnerability could cause the application to crash or potentially execute arbitrary code, affecting the confidentiality, integrity, and availability of the system.

Affected Version(s)

fontforge fontforge before 20200314

References

https://bugzilla.redhat.com/show_bug.cgi?id=1893188
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.