Advisories » MGASA-2024-0082

Updated fontforge packages fix security vulnerabilities

Publication date: 22 Mar 2024
Modification date: 21 Mar 2024
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-25081 , CVE-2024-25082

Description

Splinefont in FontForge through 20230101 allows command injection via
crafted filenames. (CVE-2024-25081)
Splinefont in FontForge through 20230101 allows command injection via
crafted archives or compressed files. (CVE-2024-25082)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=32956
• https://www.openwall.com/lists/oss-security/2024/03/08/2
• https://github.com/advisories/GHSA-rjx3-xwwm-jhj5
• https://github.com/advisories/GHSA-2j3h-j2q3-wxp3
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25081
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25082

SRPMS

9/core

• fontforge-20220308-2.1.mga9