OpenCVE

Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Redhat	Enterprise Linux

No data.

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
fontforge-0:20200314-6.el8_10	cpe:/a:redhat:enterprise_linux:8::crb	RHSA-2024:4267	2024-07-02T00:00:00Z
Red Hat Enterprise Linux 9
fontforge-0:20201107-6.el9	cpe:/a:redhat:enterprise_linux:9::crb	RHSA-2024:9439	2024-11-12T00:00:00Z

References

Link	Providers
http://www.openwall.com/lists/oss-security/2024/03/08/2
https://fontforge.org/en-US/downloads/
https://github.com/fontforge/fontforge/pull/5367
https://lists.debian.org/debian-lts-announce/2024/03/msg00007.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCH22HIO2C6M4BZWF5EYIWVFBXL5BQAH/
https://nvd.nist.gov/vuln/detail/CVE-2024-25082
https://www.cve.org/CVERecord?id=CVE-2024-25082

History

Wed, 13 Nov 2024 02:45:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:/a:redhat:enterprise_linux:9::crb

Mon, 04 Nov 2024 19:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-77
Metrics	cvssV3_1 `{'score': 4.2, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}` cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-02-26T00:00:00

Updated: 2024-11-04T18:59:45.963Z

Reserved: 2024-02-04T00:00:00

Link: CVE-2024-25082

Vulnrichment

Updated: 2024-08-01T23:36:21.542Z

NVD

Status : Awaiting Analysis

Published: 2024-02-26T16:27:58.763

Modified: 2024-11-21T09:00:12.790

Link: CVE-2024-25082

Redhat

Severity : Moderate

Publid Date: 2024-02-26T00:00:00Z

Links: CVE-2024-25082 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-25082", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-11-04T18:59:45.963Z", "dateReserved": "2024-02-04T00:00:00", "datePublished": "2024-02-26T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-05-01T19:06:21.879890"}, "descriptions": [{"lang": "en", "value": "Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://fontforge.org/en-US/downloads/"}, {"url": "https://github.com/fontforge/fontforge/pull/5367"}, {"name": "[debian-lts-announce] 20240307 [SECURITY] [DLA 3754-1] fontforge security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00007.html"}, {"name": "FEDORA-2024-e01ef71e64", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCH22HIO2C6M4BZWF5EYIWVFBXL5BQAH/"}, {"name": "[oss-security] 20240308 Vulnerabilties in FontTools & FontForge", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2024/03/08/2"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-03-12T15:44:22.139135Z", "id": "CVE-2024-25082", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-04T18:59:45.963Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:36:21.542Z"}, "title": "CVE Program Container", "references": [{"url": "https://fontforge.org/en-US/downloads/", "tags": ["x_transferred"]}, {"url": "https://github.com/fontforge/fontforge/pull/5367", "tags": ["x_transferred"]}, {"name": "[debian-lts-announce] 20240307 [SECURITY] [DLA 3754-1] fontforge security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00007.html"}, {"name": "FEDORA-2024-e01ef71e64", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCH22HIO2C6M4BZWF5EYIWVFBXL5BQAH/"}, {"name": "[oss-security] 20240308 Vulnerabilties in FontTools & FontForge", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2024/03/08/2"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://fontforge.org/en-US/downloads/", "tags": ["x_transferred"]}, {"url": "https://github.com/fontforge/fontforge/pull/5367", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00007.html", "name": "[debian-lts-announce] 20240307 [SECURITY] [DLA 3754-1] fontforge security update", "tags": ["mailing-list", "x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCH22HIO2C6M4BZWF5EYIWVFBXL5BQAH/", "name": "FEDORA-2024-e01ef71e64", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/08/2", "name": "[oss-security] 20240308 Vulnerabilties in FontTools & FontForge", "tags": ["mailing-list", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:36:21.542Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-25082", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-12T15:44:22.139135Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T15:20:37.965Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://fontforge.org/en-US/downloads/"}, {"url": "https://github.com/fontforge/fontforge/pull/5367"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00007.html", "name": "[debian-lts-announce] 20240307 [SECURITY] [DLA 3754-1] fontforge security update", "tags": ["mailing-list"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCH22HIO2C6M4BZWF5EYIWVFBXL5BQAH/", "name": "FEDORA-2024-e01ef71e64", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/08/2", "name": "[oss-security] 20240308 Vulnerabilties in FontTools & FontForge", "tags": ["mailing-list"]}], "descriptions": [{"lang": "en", "value": "Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-05-01T19:06:21.879890"}}}, "cveMetadata": {"cveId": "CVE-2024-25082", "state": "PUBLISHED", "dateUpdated": "2024-11-04T18:59:45.963Z", "dateReserved": "2024-02-04T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-02-26T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files."}, {"lang": "es", "value": "Splinefont en FontForge hasta 20230101 permite la inyecci\u00f3n de comandos a trav\u00e9s de archivos creados o comprimidos."}], "id": "CVE-2024-25082", "lastModified": "2024-11-21T09:00:12.790", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-02-26T16:27:58.763", "references": [{"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2024/03/08/2"}, {"source": "cve@mitre.org", "url": "https://fontforge.org/en-US/downloads/"}, {"source": "cve@mitre.org", "url": "https://github.com/fontforge/fontforge/pull/5367"}, {"source": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00007.html"}, {"source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCH22HIO2C6M4BZWF5EYIWVFBXL5BQAH/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2024/03/08/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://fontforge.org/en-US/downloads/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/fontforge/fontforge/pull/5367"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00007.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCH22HIO2C6M4BZWF5EYIWVFBXL5BQAH/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}