Font security 'still a Helvetica of a problem' says Australian graphics outfit Canva

Online graphic design platform Canva went looking for security problems in fonts, and found three – in "strange places." On its engineering blog, the Australian outfit explained it's "continuously looking for ways to uplift the security of [its] processes, software, supply chain, and tools," leading it to the "less explored attack surfaces, such as fonts that present a complex and prevalent part of graphics processing." That effort yielded three type-related vulns. CVE-2023-45139 is a high-severity bug (7.5/10) that describes an issue Canva found in FontTools – a library for manipulating fonts, written in Python. The package can use an untrusted XML file when processing an SVG table in an attempt to subset a font (that is, reduce its size by getting rid of unneeded scripts). The researchers used this method to produce a subsetted font with a SBG table that included an entity resolved to a password file. CVE-2024-25081 and CVE-2024-25082 are both rated 4.2/10, and are respectively associated with naming conventions and compression. Tools like FontForge and ImageMagick can rename filenames of fonts, allowing users to work within a complex naming system to better locate a desired font inside a collection. However, the need to preserve the filename can lead to security challenges when operating on untrusted data, explained Canva. The researchers were able to construct a simple proof of concept in the form of a shell execution that allowed FontForge to open files to which it shoul...