CVE-2017-17521: High severity FontForge FontForge vulnerability
Published Dec 14, 2017
·Updated
uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17534.
Affected Software
2 affected components
FontForge FontForge<=20170731
debian/fontforge<=1:20201107~dfsg-4+deb11u1, <=1:20230101~dfsg-1.1~deb12u1, <=1:20230101~dfsg-4, <=1:20230101~dfsg-8
Event History
Dec 14, 2017
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Feb 19, 2026
Data Sourced
via Debian·10:01 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-17521?
The severity of CVE-2017-17521 is high with a score of 8.8.
2
How does CVE-2017-17521 affect FontForge?
CVE-2017-17521 affects FontForge versions up to and including 20170731.
3
What is the vulnerability in uiutil.c?
The vulnerability in uiutil.c is the lack of string validation before launching the program specified by the BROWSER environment variable.
4
How can remote attackers exploit CVE-2017-17521?
Remote attackers can exploit CVE-2017-17521 by conducting argument-injection attacks via a crafted URL.
5
Where can I find more information about CVE-2017-17521?
You can find more information about CVE-2017-17521 at the following references: [1] [2]