{"id":"CVE-2020-25690","aliases":["ALSA-2020:4844","EUVD-2020-18351","GHSA-8m73-qxc4-m26m","MGASA-2020-0405","OESA-2021-1104","RHSA-2020:4844","SUSE-SU-2020:3628-1","UBUNTU-CVE-2020-25690","openSUSE-SU-2020:2111-1"],"status":"published","title":"An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD...","description":"An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01343,"percentile":0.71612,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2020-11-03T12:40:50Z","modified":"2026-10-29T11:00:22Z","fixes":[{"ecosystem":"Mageia:7","package":"fontforge","fixed_in":["20190413-1.2.mga7"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS","package":"fontforge","fixed_in":["20200314-2.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"fontforge","fixed_in":["0:20170731-15.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"fontforge-debuginfo","fixed_in":["0:20170731-15.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"fontforge-debugsource","fixed_in":["0:20170731-15.el8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20170731-15.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20190413-1.2.mga7"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-2.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20170731-15.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"fontforge-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20170731-15.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"fontforge-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20170731-15.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20170731-11.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20120731.b-5","20120731.b-5ubuntu1","20120731.b-7.1","20120731.b-7.1ubuntu0.1","20120731.b-7.1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20161005~dfsg-4+deb9u1ubuntu1","1:20170731~dfsg-1","1:20170731~dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20170731~dfsg-1build1","1:20170731~dfsg-2","1:20190801~dfsg-2","1:20190801~dfsg-2ubuntu1","1:20190801~dfsg-4","1:20190801~dfsg-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20201107~dfsg-4","1:20201107~dfsg-4build1","1:20201107~dfsg-4+deb11u1build0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20230101~dfsg-1build1","1:20230101~dfsg-1build2","1:20230101~dfsg-1.1","1:20230101~dfsg-1.1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20230101~dfsg-4build1","1:20230101~dfsg-4build2","1:20230101~dfsg-7","1:20230101~dfsg-8"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20230101~dfsg-8build1","1:20230101~dfsg-9","1:20251009+git20260808~dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20230101~dfsg-8","1:20230101~dfsg-8build1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20170731-lp151.4.6.1"}]}],"bundled":2}],"products":[{"vendor":"fontforge","product":"fontforge"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1893188","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25690","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8m73-qxc4-m26m"},{"url":"https://vulners.com/cve/CVE-2020-25690","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2020-0405.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27563","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4844","tags":["web","advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1104","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4844.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-25690","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-25690","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203628-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1160220","tags":["report"]},{"url":"https://bugzilla.suse.com/1178308","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-5395","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-25690","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZUXEDXI4LMNYPGQ23AHUPAFPEN5QAEZM/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-25690","description":"An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.","status":"published","published":"2021-02-23T03:40:04Z","modified":"2024-08-04T15:40:36.633Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:35:48.52216Z"}],"euvd":[{"id":"EUVD-2020-18351","description":"An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.","status":"published","published":"2021-02-23T03:40:04Z","modified":"2024-08-04T15:40:36Z","updated_at":"2026-11-03T03:07:17.317062Z"}],"ghsa":[{"id":"GHSA-8m73-qxc4-m26m","title":"An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD...","description":"An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.","status":"published","published":"2022-05-24T17:42:52Z","modified":"2023-01-29T05:05:50Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:45:53.268312Z"}],"nvd":[{"id":"CVE-2020-25690","description":"An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.","status":"published","published":"2021-02-23T04:15:13.71Z","modified":"2026-06-17T03:07:08.15Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:06:37.687844Z"}],"osv":[{"id":"CVE-2020-25690","description":"An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.","status":"published","published":"2021-02-23T04:15:13.71Z","modified":"2026-10-24T10:30:47.874517409Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"OESA-2021-1104","title":"fontforge security update","description":"Mozilla fontforge is an open-source web browser, designed for standards compliance, performance and portability.\r\n\r\nSecurity Fix(es):\r\n\r\nAn out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.(CVE-2020-25690)","status":"published","published":"2021-04-07T11:04:20Z","modified":"2026-08-18T01:15:24.826440515Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2020:4844","title":"Red Hat Security Advisory: fontforge security update","status":"published","published":"2024-09-13T18:12:57Z","modified":"2026-06-29T10:32:44Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"UBUNTU-CVE-2020-25690","description":"An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.","status":"published","published":"2021-02-23T04:15:00Z","modified":"2026-10-17T12:55:52.435636544Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"ALSA-2020:4844","title":"Moderate: fontforge security update","description":"FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. \n\nSecurity Fix(es):\n\n* fontforge: SFD_GetFontMetaData() insufficient CVE-2020-5395 backport (CVE-2020-25690)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2020-11-03T12:40:50Z","modified":"2026-10-29T11:00:22.856840739Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"MGASA-2020-0405","title":"Updated fontforge packages fix a security vulnerability","description":"SFD_GetFontMetaData() insufficient CVE-2020-5395 backport. (CVE-2020-25690)\n","status":"published","published":"2020-11-08T14:14:27Z","modified":"2026-04-16T04:42:54.82484651Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2020:2111-1","title":"Security update for fontforge","description":"This update for fontforge fixes the following issues:\n\n- fix for Use-after-free (heap) in the SFD_GetFontMetaData() function and the crash (bsc#1178308 CVE-2020-25690).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-11-29T15:22:25Z","modified":"2026-02-04T04:39:22.079593Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"SUSE-SU-2020:3628-1","title":"Security update for fontforge","description":"This update for fontforge fixes the following issues:\n\n- fix for Use-after-free (heap) in the SFD_GetFontMetaData() function and the crash (bsc#1178308 CVE-2020-25690).\n","status":"published","published":"2020-12-04T16:02:56Z","modified":"2026-02-04T02:56:21.389796Z","updated_at":"2026-11-02T15:53:48.690034Z"}]}}