CVE-2017-17521
uiutil.c in FontForge through 20170731 does not validate strings before launching the program...
CVE-2017-17521 is a high vulnerability (CVSS 8.8) in Fontforge, published December 14, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.85%, the 79th percentile. Fixed in fontforge 1:20201107~dfsg-1.
uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17534.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17534.
- Record
CVE-2017-17521- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-74
- Updated
- 2026-11-02
CVE List No score
uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17534.
- Record
CVE-2017-17521- Updated
- 2026-11-02
EUVDEUVD-2017-8681 No score
uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17534.
- Record
EUVD-2017-8681- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8vv4-vqx2-f85v
uiutil.c in FontForge through 20170731 does not validate strings before launching the program...
uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17534.
- Record
GHSA-8vv4-vqx2-f85v- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
OSV
uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17534.
- Record
CVE-2017-17521- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-17521
uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17534.
- Record
DEBIAN-CVE-2017-17521- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-17521
uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17534.
- Record
UBUNTU-CVE-2017-17521- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14981-1 No score
fontforge-20230101-6.1 on GA media
These are all security issues fixed in the fontforge-20230101-6.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14981-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:1199-1 No score
Security update for fontforge
This update for fontforge fixes the following issues:
- CVE-2017-17521: Fixed command injection in help function uiutil.c (bsc#1073014)
- Record
SUSE-SU-2025:1199-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fontforgeDebian:12 |
before 1:20201107~dfsg-1 | 1:20201107~dfsg-1 |
fontforgeDebian:13 |
before 1:20201107~dfsg-1 | 1:20201107~dfsg-1 |
fontforgeDebian:14 |
before 1:20201107~dfsg-1 | 1:20201107~dfsg-1 |
fontforgeSUSE:Linux Enterprise Module for Desktop Applications 15 SP6 |
before 20200314-150200.3.9.1 | 20200314-150200.3.9.1 |
fontforgeopenSUSE:Leap 15.6 |
before 20200314-150200.3.9.1 | 20200314-150200.3.9.1 |
fontforgeUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 20120731.b-520120731.b-5ubuntu120120731.b-7.120120731.b-7.1ubuntu0.120120731.b-7.1ubuntu0.1+esm1 |
None known |
fontforgeUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1:20161005~dfsg-4+deb9u1ubuntu11:20170731~dfsg-11:20170731~dfsg-1ubuntu0.1~esm1 |
None known |
fontforgeUbuntu:20.04:LTS |
All versions, plus listed versions 1:20170731~dfsg-1build11:20170731~dfsg-21:20190801~dfsg-21:20190801~dfsg-2ubuntu11:20190801~dfsg-41:20190801~dfsg-4ubuntu0.1 |
None known |
fontforgeUbuntu:22.04:LTS |
All versions, plus listed versions 1:20201107~dfsg-41:20201107~dfsg-4build11:20201107~dfsg-4+deb11u1build0.22.04.1 |
None known |
fontforgeUbuntu:24.04:LTS |
All versions, plus listed versions 1:20230101~dfsg-1build11:20230101~dfsg-1build21:20230101~dfsg-1.11:20230101~dfsg-1.1build1 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
fontforgeUbuntu:25.10 |
All versions, plus listed versions 1:20230101~dfsg-4build11:20230101~dfsg-4build21:20230101~dfsg-71:20230101~dfsg-8 |
None known |
fontforgeUbuntu:26.10 |
All versions, plus listed versions 1:20230101~dfsg-8build11:20230101~dfsg-91:20251009+git20260808~dfsg-2 |
None known |
fontforgeUbuntu:26.04:LTS |
All versions, plus listed versions 1:20230101~dfsg-81:20230101~dfsg-8build1 |
None known |
fontforgeopenSUSE:Tumbleweed |
before 20230101-6.1 | 20230101-6.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |