CVE-2017-11575

EUVD-2017-3190
FontForge 20161012 is vulnerable to a buffer over-read in strnmatch (char.c) resulting in DoS or code execution via a crafted otf file, related to a call from the readttfcopyrights function in parsettf.c.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 57%
Debian logo
Debian Releases
Debian Product
Codename
fontforge
bookworm
1:20230101~dfsg-1.1~deb12u1
fixed
bookworm (security)
1:20230101~dfsg-1.1~deb12u1
fixed
bullseye
1:20201107~dfsg-4+deb11u1
fixed
bullseye (security)
1:20201107~dfsg-4+deb11u1
fixed
sid
1:20230101~dfsg-4
fixed
trixie
1:20230101~dfsg-4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
fontforge
artful
ignored
bionic
not-affected
cosmic
not-affected
trusty
Fixed 20120731.b-5ubuntu0.1
released
xenial
Fixed 20120731.b-7.1ubuntu0.1
released
zesty
ignored
Common Weakness Enumeration
References
http://www.debian.org/security/2017/dsa-3958
https://github.com/fontforge/fontforge/issues/3096
http://www.debian.org/security/2017/dsa-3958
https://github.com/fontforge/fontforge/issues/3096