CVE-2020-25690
High
Description
An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
SeverityHigh
CVSS8.8
Exploit probability—
ProductFontforge
PublishedFeb 23, 2021
First seenFeb 23, 2021
Weakness typeCWE-119Memory buffer bounds error
How to fix
Update
- fontforge fontforge20200314 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fontforge fontforge | v < 20200314 | 20200314 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.