CVE-2017-11571

FontForge 20161012 is vulnerable to a stack-based buffer overflow in addnibble (parsettf.c) resulting in DoS or code execution via a crafted otf file.

It was discovered that FontForge, a font editor, did not correctly validate its input. An attacker could use this flaw by tricking a user into opening a maliciously crafted OpenType font file, thus causing a denial-of-service via application crash, or execution of arbitrary code (CVE-2017-11568, CVE-2017-11569, CVE-2017-11571, CVE-2017-11572, CVE-2017-11574, CVE-2017-11575, CVE-2017-11576, CVE-2017-11577).

This update for fontforge fixes the following security issues:

fontforge was updated to 20170731, fixings lots of bugs and security issues.

• CVE-2017-11568: Heap-based buffer over-read in PSCharStringToSplines (bsc#1050161)
• CVE-2017-11569: Heap-based buffer over-read in readttfcopyrights (bsc#1050181)
• CVE-2017-11571: Stack-based buffer overflow in addnibble (bsc#1050185)
• CVE-2017-11572: Heap-based buffer over-read in readcfftopdicts (bsc#1050187)
• CVE-2017-11573: Over-read in ValidatePostScriptFontName (bsc#1050193)
• CVE-2017-11574: Heap-based buffer overflow in readcffset (bsc#1050194)
• CVE-2017-11575: Buffer over-read in strnmatch (bsc#1050195)
• CVE-2017-11576: Ensure a positive size in a weight vector memcpycall in readcfftopdict (bsc#1050196)
• CVE-2017-11577: Buffer over-read in getsid (bsc#1050200)

It was discovered that FontForge was vulnerable to a heap-based buffer over-read. A remote attacker could use a crafted file to DoS or execute arbitrary code. (CVE-2017-11568, CVE-2017-11569, CVE-2017-11572)

It was discovered that FontForge was vulnerable to a stack-based buffer overflow. A remote attacker could use a crafted file to DoS or execute arbitrary code. (CVE-2017-11571)

It was discovered that FontForge was vulnerable to a heap-based buffer overflow. A remote attacker could use a crafted file to DoS or execute arbitrary code. (CVE-2017-11574)

It was discovered that FontForge was vulnerable to a buffer over-read. A remote attacker could use a crafted file to DoS or execute arbitrary code. (CVE-2017-11575, CVE-2017-11577)

It was discovered that FontForge wasn't correctly checking the sign of a vector size. A remote attacker could use a crafted file to DoS. (CVE-2017-11576)