Vulnerabilties in FontTools & FontForge

[Alan Coopersmith <alan.coopersmith () oracle com>]

https://www.canva.dev/blog/engineering/fonts-are-still-a-helvetica-of-a-problem/
is a detailed blog about vulnerabilities in some open source font handling software.

It discusses three new vulnerabilities in particular:

- CVE-2023-45139 in FontTools versions >=4.28.2, <4.43.0, fixed in 4.43.0

   FontTools uses lxml to process SVG tables in OpenType fonts, and had
   not disabled external entity expansion (which lmxl enables by default),
   leading to an XML External Entity (XXE) vulnerability.

   The project has issued it's own advisory for this at:
   https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5

- CVE-2024-25081 & CVE-2024-25082 in FontForge, fixed in git repo

   FontForge used the system() function to execute commands to unpack fonts
   from archives, and the command line arguments it provides include both the
   name of the archive and the name of a font file specified inside the archive,
   leading to a classic command injection vulnerability if used to unpack a
   specially-named or a specially-crafted archive file.

   A patch to switch from system() to glib's g_spawn_sync() was merged
   upstream on Feb. 6, but there don't seem to be any new releases yet:
   https://github.com/fontforge/fontforge/pull/5367

--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris