CVE-2017-11575: High severity fonts vulnerability

Published Jul 23, 2017

Updated

FontForge 20161012 is vulnerable to a buffer over-read in strnmatch (char.c) resulting in DoS or code execution via a crafted otf file, related to a call from the readttfcopyrights function in parsettf.c.

Affected Software

1 affected component

FontForge FontForge=20161012

Remediation

Patch Available

https://github.com/fontforge/fontforge/issues/3096

Event History

Jul 23, 2017

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2017-11575?

CVE-2017-11575 has been classified as a critical vulnerability due to its potential to cause a denial of service (DoS) or allow code execution.

How do I fix CVE-2017-11575?

To fix CVE-2017-11575, update FontForge to a version newer than 20161012 that addresses this vulnerability.

What kind of exploit is possible with CVE-2017-11575?

CVE-2017-11575 can be exploited to trigger a buffer over-read when processing a maliciously crafted OpenType font file.

Which versions of FontForge are affected by CVE-2017-11575?

CVE-2017-11575 specifically affects FontForge version 20161012.

Is CVE-2017-11575 related to any functions in the software?

Yes, CVE-2017-11575 is related to a flaw in the readttfcopyrights function in parsettf.c, which can lead to the vulnerability.