{"id":"CVE-2014-2570","aliases":["DEBIAN-CVE-2014-2570","EUVD-2014-2605","GHSA-fh3h-pv2j-78c4","UBUNTU-CVE-2014-2570"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in www/make_subset.php in PHP Font Lib before 0.3.1...","description":"Cross-site scripting (XSS) vulnerability in www/make_subset.php in PHP Font Lib before 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02135,"percentile":0.82124,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2015-08-31T18:00:00Z","modified":"2026-10-23T15:47:37Z","fixes":[{"ecosystem":"Debian:12","package":"php-font-lib","fixed_in":["0.3.1+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"php-font-lib","fixed_in":["0.3.1+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"php-font-lib","fixed_in":["0.3.1+dfsg-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"php-font-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"php-font-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"php-font-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1+dfsg-2"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php-font-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.2+dfsg-2","0.2.2+dfsg-2build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"php-font-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.1+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"php-font-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.1+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"php-font-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.1+dfsg-3.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"php-font-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.4+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"php-font-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"php-font-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"php-font-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-1","1.0.2-1"]}],"products":[{"vendor":"php_font_lib_project","product":"php_font_lib"}],"references":[{"url":"https://github.com/PhenX/php-font-lib/commit/d13682b7e27d14a6323c441426f3dde1cd86c751","tags":["x_refsource_CONFIRM","x_transferred","fix"]},{"url":"http://osvdb.org/show/osvdb/104896","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"https://github.com/PhenX/php-font-lib/releases/tag/0.3.1","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://www.securityfocus.com/bid/66380","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit","evidence"]},{"url":"http://codalabs.net/cla-2014-001","tags":["x_refsource_MISC","x_transferred","Exploit","evidence"]},{"url":"http://www.securityfocus.com/archive/1/531587/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2570"},{"url":"https://github.com/advisories/GHSA-fh3h-pv2j-78c4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-2570","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-2570","tags":["report"]},{"url":"http://seclists.org/bugtraq/2014/Mar/128","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-2570","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-2570","description":"Cross-site scripting (XSS) vulnerability in www/make_subset.php in PHP Font Lib before 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.","status":"published","published":"2015-08-31T18:00:00Z","modified":"2024-08-06T10:21:35.895Z","updated_at":"2026-11-02T14:33:44.23164Z"}],"euvd":[{"id":"EUVD-2014-2605","description":"Cross-site scripting (XSS) vulnerability in www/make_subset.php in PHP Font Lib before 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.","status":"published","published":"2015-08-31T18:00:00Z","modified":"2024-08-06T10:21:35Z","updated_at":"2026-11-03T01:57:14.00634Z"}],"ghsa":[{"id":"GHSA-fh3h-pv2j-78c4","title":"Cross-site scripting (XSS) vulnerability in www/make_subset.php in PHP Font Lib before 0.3.1...","description":"Cross-site scripting (XSS) vulnerability in www/make_subset.php in PHP Font Lib before 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.","status":"published","published":"2022-05-14T02:53:07Z","modified":"2023-02-02T05:06:48Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:52:22.08324Z"}],"nvd":[{"id":"CVE-2014-2570","description":"Cross-site scripting (XSS) vulnerability in www/make_subset.php in PHP Font Lib before 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.","status":"published","published":"2015-08-31T18:59:05.557Z","modified":"2026-06-17T00:06:49.037Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:58.385843Z"}],"osv":[{"id":"CVE-2014-2570","description":"Cross-site scripting (XSS) vulnerability in www/make_subset.php in PHP Font Lib before 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.","status":"published","published":"2015-08-31T18:59:05Z","modified":"2026-04-10T03:43:41.730188Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-2570","description":"Cross-site scripting (XSS) vulnerability in www/make_subset.php in PHP Font Lib before 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.","status":"published","published":"2015-08-31T18:59:05.557Z","modified":"2026-10-23T15:47:37.229904Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"UBUNTU-CVE-2014-2570","description":"Cross-site scripting (XSS) vulnerability in www/make_subset.php in PHP Font Lib before 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.","status":"published","published":"2015-08-31T18:59:00Z","modified":"2026-10-17T12:52:40.293692846Z","updated_at":"2026-11-02T15:54:09.010095Z"}]}}