fontforge (SUSE:Linux Enterprise Software Development Kit 12 SP5) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Software Development Kit 12 SP5 package fontforge, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (5)

• CVE-2020-25690 — CVSS 8.8 (high): An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount…
• CVE-2020-5395 — CVSS 8.8 (high): FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c.
• CVE-2020-5496 — CVSS 8.8 (high): FontForge 20190801 has a heap-based buffer overflow in the Type2NotDefSplines() function in splinesave.c.
• CVE-2024-25082 — CVSS 6.5 (medium): Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.
• CVE-2024-25081 — CVSS 4.2 (medium): Splinefont in FontForge through 20230101 allows command injection via crafted filenames.