RHSA-2024:9439: Moderate: fontforge security update
FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): fontforge: command injection via crafted archives or compressed files (CVE-2024-25082) fontforge: command injection via crafted filenames (CVE-2024-25081) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.5 Release Notes linked from the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2024:9439?
The severity of RHSA-2024:9439 is classified as important due to potential command injection vulnerabilities.
How do I fix RHSA-2024:9439?
To fix RHSA-2024:9439, update the affected fontforge packages to version 20201107-6.el9 or later.
What products are affected by RHSA-2024:9439?
The affected products include Red Hat CodeReady Linux Builder for various architectures, specifically the fontforge package.
What vulnerabilities does RHSA-2024:9439 address?
RHSA-2024:9439 addresses command injection vulnerabilities that can occur via crafted input in the FontForge application.
Is RHSA-2024:9439 applicable to all versions of FontForge?
RHSA-2024:9439 specifically applies to versions prior to 20201107-6.el9 of FontForge.