{"id":"CVE-2024-25082","aliases":["ALSA-2024:4267","ALSA-2024:9439","DEBIAN-CVE-2024-25082","DLA-3754-1","DSA-5641-1","EUVD-2024-22444","GHSA-2j3h-j2q3-wxp3","MGASA-2024-0082","OESA-2024-1228","RHSA-2024:4267","RHSA-2024:9439","RHSA-2026:2566","RLSA-2024:4267","RLSA-2024:9439","SUSE-SU-2024:0863-1","SUSE-SU-2024:0864-1","UBUNTU-CVE-2024-25082","USN-6856-1"],"status":"published","title":"Splinefont in FontForge through 20230101 allows command injection via crafted archives or...","description":"Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.01854,"percentile":0.79445,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-77"],"published":"2024-02-26T00:00:00Z","modified":"2026-11-02T12:01:33Z","exploits":[{"source":"pocgithub","id":"AliElKhatteb/CVE-2024-25082_CVE-2024-25081","title":"AliElKhatteb/CVE-2024-25082_CVE-2024-25081","date":"2026-03-15","url":"https://github.com/AliElKhatteb/CVE-2024-25082_CVE-2024-25081"},{"source":"pocgithub","id":"moamenx8/CVE-2024-25082","title":"moamenx8/CVE-2024-25082","date":"2026-03-16","url":"https://github.com/moamenx8/CVE-2024-25082"}],"fixes":[{"ecosystem":"Debian:12","package":"fontforge","fixed_in":["1:20230101~dfsg-1.1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"fontforge","fixed_in":["1:20230101~dfsg-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"fontforge","fixed_in":["1:20230101~dfsg-1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"fontforge","fixed_in":["20120731.b-7.1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"fontforge","fixed_in":["1:20170731~dfsg-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"fontforge","fixed_in":["1:20190801~dfsg-4ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"fontforge","fixed_in":["1:20201107~dfsg-4+deb11u1build0.22.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-6.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20201107-6.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20230101~dfsg-1.1~deb12u1"}]}],"versions":["1:20230101~dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20230101~dfsg-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20230101~dfsg-1.1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20170731~dfsg-1+deb10u1"}]}],"versions":["1:20170731~dfsg-1"],"bundled":4},{"source":"osv","ecosystem":"Debian:11","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20201107~dfsg-4+deb11u1"}]}],"versions":["1:20201107~dfsg-4"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20230101~dfsg-1.1~deb12u1"}]}],"versions":["1:20230101~dfsg-1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20220308-2.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-5.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-5.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-8.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-8.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-8.oe2203sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-8.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200314-6.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"fontforge-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200314-6.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"fontforge-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200314-6.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20201107-6.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"fontforge-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20201107-6.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"fontforge-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20201107-6.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20201107-6.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"fontforge-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20201107-6.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"fontforge-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20201107-6.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20200314-6.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20201107-6.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20170731-11.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-150200.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-150200.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-150200.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-150200.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-150200.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-150200.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-150200.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-150200.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-150200.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-150200.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-150200.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-150200.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20200314-150200.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20120731.b-7.1ubuntu0.1+esm1"}]}],"versions":["20120731.b-5","20120731.b-5ubuntu1","20120731.b-7.1","20120731.b-7.1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20170731~dfsg-1ubuntu0.1~esm1"}]}],"versions":["1:20161005~dfsg-4+deb9u1ubuntu1","1:20170731~dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20190801~dfsg-4ubuntu0.1"}]}],"versions":["1:20170731~dfsg-1build1","1:20170731~dfsg-2","1:20190801~dfsg-2","1:20190801~dfsg-2ubuntu1","1:20190801~dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20201107~dfsg-4+deb11u1build0.22.04.1"}]}],"versions":["1:20201107~dfsg-4","1:20201107~dfsg-4build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20120731.b-7.1ubuntu0.1+esm1"}]}],"versions":["20120731.b-5","20120731.b-5ubuntu1","20120731.b-7.1","20120731.b-7.1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20170731~dfsg-1ubuntu0.1~esm1"}]}],"versions":["1:20161005~dfsg-4+deb9u1ubuntu1","1:20170731~dfsg-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20190801~dfsg-4ubuntu0.1"}]}],"versions":["1:20170731~dfsg-1build1","1:20170731~dfsg-2","1:20190801~dfsg-2","1:20190801~dfsg-2ubuntu1","1:20190801~dfsg-4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"fontforge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20201107~dfsg-4+deb11u1build0.22.04.1"}]}],"versions":["1:20201107~dfsg-4","1:20201107~dfsg-4build1"],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"fontforge","product":"fontforge"}],"references":[{"url":"https://fontforge.org/en-US/downloads/","tags":["x_transferred","Product","web","report"]},{"url":"https://github.com/fontforge/fontforge/pull/5367","tags":["x_transferred","Patch","fix","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00007.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCH22HIO2C6M4BZWF5EYIWVFBXL5BQAH/","tags":["vendor-advisory","x_transferred","Issue Tracking","Mailing List","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/08/2","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCH22HIO2C6M4BZWF5EYIWVFBXL5BQAH/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25082","tags":["advisory"]},{"url":"https://fontforge.org/en-US/downloads"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCH22HIO2C6M4BZWF5EYIWVFBXL5BQAH"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCH22HIO2C6M4BZWF5EYIWVFBXL5BQAH"},{"url":"https://github.com/advisories/GHSA-2j3h-j2q3-wxp3","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4267","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-25081","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-25082","tags":["report"]},{"url":"https://bugzilla.redhat.com/2266180","tags":["report"]},{"url":"https://bugzilla.redhat.com/2266181","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-4267.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9439","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-9439.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25082.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-25082","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0082.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32956","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/03/08/2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rjx3-xwwm-jhj5","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1228","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25081","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266180","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266181","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4267.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-25081","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-25082","tags":["advisory","report"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9439.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2566","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426429","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2566.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15269","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15269","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15269","tags":["advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1195/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15275","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15275","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15275","tags":["advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1189/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15279","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15279","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15279","tags":["advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1184/","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2024:4267","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:9439","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240863-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220404","tags":["report"]},{"url":"https://bugzilla.suse.com/1220405","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25082","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240864-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-25082","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6856-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-25081","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-25082","description":"Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.","status":"published","published":"2024-02-26T00:00:00Z","modified":"2025-11-04T18:29:18.415Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:34:04.341725Z"}],"euvd":[{"id":"EUVD-2024-22444","description":"Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.","status":"published","published":"2024-02-26T00:00:00Z","modified":"2025-11-04T18:29:18Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:23.723839Z"}],"ghsa":[{"id":"GHSA-2j3h-j2q3-wxp3","title":"Splinefont in FontForge through 20230101 allows command injection via crafted archives or...","description":"Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.","status":"published","published":"2024-02-26T18:30:31Z","modified":"2025-11-04T21:31:14Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:04:36.536202Z"}],"nvd":[{"id":"CVE-2024-25082","description":"Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.","status":"published","published":"2024-02-26T16:27:58.763Z","modified":"2026-06-17T07:15:28.273Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:09:38.473056Z"}],"osv":[{"id":"CVE-2024-25082","description":"Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.","status":"published","published":"2024-02-26T00:00:00Z","modified":"2026-10-28T02:30:57.696631864Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:38.897406Z"},{"id":"DEBIAN-CVE-2024-25082","description":"Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.","status":"published","published":"2024-02-26T16:27:58.763Z","modified":"2026-11-02T12:01:33.303722292Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"OESA-2024-1228","title":"fontforge security update","description":"FontForge (former PfaEdit) is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.\r\n\r\nSecurity Fix(es):\r\n\r\nSplinefont in FontForge through 20230101 allows command injection via crafted filenames.(CVE-2024-25081)\r\n\r\nSplinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.(CVE-2024-25082)","status":"published","published":"2024-03-01T11:06:40Z","modified":"2026-08-18T01:18:17.597508991Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"RHSA-2024:4267","title":"Red Hat Security Advisory: fontforge security update","status":"published","published":"2024-09-14T00:00:06Z","modified":"2026-06-29T10:59:13Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:9439","title":"Red Hat Security Advisory: fontforge security update","status":"published","published":"2024-11-15T16:23:05Z","modified":"2026-06-29T11:03:30Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2026:2566","title":"Red Hat Security Advisory: fontforge security update","status":"published","published":"2026-02-12T10:10:53Z","modified":"2026-07-09T10:09:57Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RLSA-2024:4267","title":"Moderate: fontforge security update","description":"FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. \n\nSecurity Fix(es):\n\n* fontforge: command injection via crafted filenames (CVE-2024-25081)\n\n* fontforge: command injection via crafted archives or compressed files (CVE-2024-25082)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-05-07T19:12:05.053102Z","modified":"2025-05-07T20:08:46.754655Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2024:9439","title":"Moderate: fontforge security update","description":"FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. \n\nSecurity Fix(es):\n\n* fontforge: command injection via crafted archives or compressed files (CVE-2024-25082)\n\n* fontforge: command injection via crafted filenames (CVE-2024-25081)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.","status":"published","published":"2025-03-17T20:16:45.510776Z","modified":"2025-10-09T06:18:55.701361Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"UBUNTU-CVE-2024-25082","description":"Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.","status":"published","published":"2024-02-26T16:27:00Z","modified":"2026-04-22T14:42:17.483809Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"ALSA-2024:4267","title":"Moderate: fontforge security update","description":"FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. \n\nSecurity Fix(es):\n\n* fontforge: command injection via crafted filenames (CVE-2024-25081)\n* fontforge: command injection via crafted archives or compressed files (CVE-2024-25082)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-07-02T00:00:00Z","modified":"2026-10-29T11:02:21.393890945Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:9439","title":"Moderate: fontforge security update","description":"FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts.   \n\nSecurity Fix(es):  \n\n  * fontforge: command injection via crafted archives or compressed files (CVE-2024-25082)\n  * fontforge: command injection via crafted filenames (CVE-2024-25081)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n","status":"published","published":"2024-11-12T00:00:00Z","modified":"2026-10-29T11:31:53.207598697Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"DLA-3754-1","title":"fontforge - security update","status":"published","published":"2024-03-08T00:00:00Z","modified":"2026-03-09T01:18:41.504916Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5641-1","title":"fontforge - security update","status":"published","published":"2024-03-19T00:00:00Z","modified":"2026-03-09T02:11:15.46482Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2024-0082","title":"Updated fontforge packages fix security vulnerabilities","description":"Splinefont in FontForge through 20230101 allows command injection via\ncrafted filenames. (CVE-2024-25081)\nSplinefont in FontForge through 20230101 allows command injection via\ncrafted archives or compressed files. (CVE-2024-25082)\n","status":"published","published":"2024-03-22T00:19:51Z","modified":"2026-04-16T04:41:22.032127754Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"SUSE-SU-2024:0863-1","title":"Security update for fontforge","description":"This update for fontforge fixes the following issues:\n\n- CVE-2024-25081: Fixed command injection via crafted filenames (bsc#1220404).\n- CVE-2024-25082: Fixed command injection via crafted archives or compressed files (bsc#1220405).\n","status":"published","published":"2024-03-13T08:58:13Z","modified":"2026-02-04T03:57:31.657701Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0864-1","title":"Security update for fontforge","description":"This update for fontforge fixes the following issues:\n\n- CVE-2024-25081: Fixed command injection via crafted filenames (bsc#1220404).\n- CVE-2024-25082: Fixed command injection via crafted archives or compressed files (bsc#1220405).\n","status":"published","published":"2024-03-13T08:59:23Z","modified":"2026-02-04T02:34:40.075502Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"USN-6856-1","title":"fontforge vulnerabilities","description":"It was discovered that FontForge incorrectly handled filenames. If a user or an\nautomated system were tricked into opening a specially crafted input file, a\nremote attacker could possibly use this issue to perform a command injection.\n(CVE-2024-25081)\n\nIt was discovered that FontForge incorrectly handled archives and compressed\nfiles. If a user or an automated system were tricked into opening a specially\ncrafted input file, a remote attacker could possibly use this issue to perform\ncommand injection. (CVE-2024-25082)\n","status":"published","published":"2024-06-27T09:52:34Z","modified":"2026-06-25T13:32:28.721519764Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}